Is it gone?

wes · December 5, 2008

I was having issues on my laptop and I think I've managed to clean it but I just wanted someone to verify

Logs:

Malwarebytes' Anti-Malware 1.30

Database version: 1306

Windows 5.1.2600 Service Pack 3

05/12/2008 19:38:18

mbam-log-2008-12-05 (19-38-18).txt

Scan type: Quick Scan

Objects scanned: 50619

Time elapsed: 4 minute(s), 26 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

*****************************************

;*******************************************************************************

********************************************************************************

*

*******************

ANALYSIS: 2008-12-05 21:17:07

PROTECTIONS: 1

MALWARE: 16

SUSPECTS: 0

;*******************************************************************************

********************************************************************************

*

*******************

PROTECTIONS

Description Version Active Updated

;===============================================================================

================================================================================

=

===================

Sophos Antivirus 7.6.0 No No

;===============================================================================

================================================================================

=

===================

MALWARE

Id Description Type Active Severity Disinfectable Disinfected Location

;===============================================================================

================================================================================

=

===================

00139059 Cookie/Traffic Marketplace TrackingCookie No 0 Yes No C:\Documents and Settings\teacher\Cookies\teacher@trafficmp[1].txt

00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Documents and Settings\teacher\Cookies\teacher@atdmt[2].txt

00145405 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Documents and Settings\teacher\Cookies\teacher@247realmedia[2].txt

00145731 Cookie/Tribalfusion TrackingCookie No 0 Yes No C:\Documents and Settings\teacher\Cookies\teacher@tribalfusion[1].txt

00145881 Cookie/NewMedia TrackingCookie No 0 Yes No C:\Documents and Settings\teacher\Cookies\teacher@anm.co[1].txt

00167642 Cookie/Com.com TrackingCookie No 0 Yes No C:\Documents and Settings\teacher\Cookies\teacher@com[1].txt

00167724 Cookie/HotLog TrackingCookie No 0 Yes No C:\Documents and Settings\teacher\Cookies\teacher@hotlog[2].txt

00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\teacher\Cookies\teacher@serving-sys[1].txt

00168093 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\teacher\Cookies\teacher@bs.serving-sys[1].txt

00168097 Cookie/BurstBeacon TrackingCookie No 0 Yes No C:\Documents and Settings\teacher\Cookies\teacher@www.burstbeacon[1].txt

00168109 Cookie/Adtech TrackingCookie No 0 Yes No C:\Documents and Settings\teacher\Cookies\teacher@adtech[1].txt

00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Documents and Settings\teacher\Cookies\teacher@advertising[2].txt

00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\Documents and Settings\teacher\Cookies\teacher@ads.pointroll[2].txt

00170554 Cookie/Overture TrackingCookie No 0 Yes No C:\Documents and Settings\teacher\Cookies\teacher@overture[2].txt

00170556 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Documents and Settings\teacher\Cookies\teacher@realmedia[1].txt

00171982 Cookie/QuestionMarket TrackingCookie No 0 Yes No C:\Documents and Settings\teacher\Cookies\teacher@questionmarket[1].txt

;===============================================================================

================================================================================

=

===================

SUSPECTS

Sent Location _8

;===============================================================================

================================================================================

=

===================

;===============================================================================

================================================================================

=

===================

VULNERABILITIES

Id Severity Description _8

;===============================================================================

================================================================================

=

===================

;===============================================================================

================================================================================

=

===================

**********************************

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 21:20:54, on 05/12/2008

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16735)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

c:\Program Files\Sophos\Sophos Anti-Virus\SavService.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

C:\WINDOWS\system32\agrsmsvc.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe

C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

c:\Program Files\Sophos\Sophos Anti-Virus\SAVAdminService.exe

c:\Program Files\Sophos\AutoUpdate\ALsvc.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\TODDSrv.exe

C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe

C:\WINDOWS\system32\wdfmgr.exe

C:\Program Files\RealVNC\VNC4\WinVNC4.exe

C:\WINDOWS\System32\alg.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Apoint2K\Apntex.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\utils\DigiGuide TV Guide\digiguide.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.co.uk/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy1.equinoxsolutions.com:80

O2 - BHO: Sophos Web Content Scanner - {39EA7695-B3F2-4C44-A4BC-297ADA8FD235} - c:\Program Files\Sophos\Sophos Anti-Virus\SophosBHO.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll

O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll

O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [CeEKEY] C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe

O4 - HKLM\..\Run: [HWSetup] C:\Program Files\TOSHIBA\TOSHIBA Applet\HWSetup.exe hwSetUP

O4 - HKLM\..\Run: [sVPWUTIL] C:\Program Files\Toshiba\Windows Utilities\SVPWUTIL.exe SVPwUTIL

O4 - HKLM\..\Run: [TPNF] C:\Program Files\TOSHIBA\TouchPad\TPTray.exe

O4 - HKLM\..\Run: [TCtryIOHook] TCtrlIOHook.exe

O4 - HKLM\..\Run: [TFncKy] TFncKy.exe

O4 - HKLM\..\Run: [TDispVol] TDispVol.exe

O4 - HKLM\..\Run: [TPSMain] TPSMain.exe

O4 - HKLM\..\Run: [Zooming] ZoomingHook.exe

O4 - HKLM\..\Run: [smoothView] C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe

O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe

O4 - HKLM\..\Run: [DDWMon] C:\Program Files\TOSHIBA\TOSHIBA Direct Disc Writer\\ddwmon.exe

O4 - HKLM\..\Run: [topi] C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe -startup

O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe

O4 - HKLM\..\Run: [CFSServ.exe] CFSServ.exe -NoClient

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min

O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe

O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [VirTrigger] "C:\Program Files\VirTrigger\VirTrigger.exe"

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Startup: DigiGuide TV Guide.lnk = C:\Program Files\utils\DigiGuide TV Guide\Client.exe

O4 - Global Startup: AutoUpdate Monitor.lnk = C:\Program Files\Sophos\AutoUpdate\ALMon.exe

O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm

O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll

O9 - Extra button: (no name) - {3B8FB116-D358-48A3-A5C7-DB84F15CBB04} - http://www.ietoolexpress.com/redirect.php (file missing)

O9 - Extra 'Tools' menuitem: IExplorer Security - {3B8FB116-D358-48A3-A5C7-DB84F15CBB04} - http://www.ietoolexpress.com/redirect.php (file missing)

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd...b?1209732486552

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab

O20 - AppInit_DLLs: c:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL

O22 - SharedTaskScheduler: crimsonness - {e0feeb92-908e-46d2-8a66-88c5295f2629} - C:\WINDOWS\system32\tiltmeo.dll (file missing)

O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\WINDOWS\system32\agrsmsvc.exe

O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe

O23 - Service: Sophos Anti-Virus status reporter (SAVAdminService) - Sophos Plc - c:\Program Files\Sophos\Sophos Anti-Virus\SAVAdminService.exe

O23 - Service: Sophos Anti-Virus (SAVService) - Sophos Plc - c:\Program Files\Sophos\Sophos Anti-Virus\SavService.exe

O23 - Service: Sophos AutoUpdate Service - Sophos Plc - c:\Program Files\Sophos\AutoUpdate\ALsvc.exe

O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\WINDOWS\system32\TODDSrv.exe

O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe

O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\RealVNC\VNC4\WinVNC4.exe

--

End of file - 9372 bytes

Tigger93 · December 9, 2008

Sorry for the delay. Do you still require any assistance?

wes · December 10, 2008

Sorry for the delay. Do you still require any assistance?

YES PLEASE ! I'm not sure if I'm clean, previous scan looked good- as in nothing found. Just did another scan on Spybot & got the following :

--- Search result list ---

Hint of the Day: Click the bar at the right of this to see more information! ()

DoubleClick: Tracking cookie (Firefox: default) (Cookie, nothing done)

Adviva: Tracking cookie (Firefox: default) (Cookie, nothing done)

AdRevolver: Tracking cookie (Firefox: default) (Cookie, nothing done)

HitBox: Tracking cookie (Firefox: default) (Cookie, nothing done)

WebTrends live: Tracking cookie (Firefox: default) (Cookie, nothing done)

MediaPlex: Tracking cookie (Firefox: default) (Cookie, nothing done)

AdRevolver: Tracking cookie (Firefox: default) (Cookie, nothing done)

CasaleMedia: Tracking cookie (Firefox: default) (Cookie, nothing done)

FastClick: Tracking cookie (Firefox: default) (Cookie, nothing done)

CasaleMedia: Tracking cookie (Firefox: default) (Cookie, nothing done)

BlueStreak: Tracking cookie (Firefox: default) (Cookie, nothing done)

Adviva: Tracking cookie (Firefox: default) (Cookie, nothing done)

Tradedoubler: Tracking cookie (Firefox: default) (Cookie, nothing done)

Statcounter: Tracking cookie (Firefox: default) (Cookie, nothing done)

Tradedoubler: Tracking cookie (Firefox: default) (Cookie, nothing done)

Statcounter: Tracking cookie (Firefox: default) (Cookie, nothing done)

MediaPlex: Tracking cookie (Firefox: default) (Cookie, nothing done)

DoubleClick: Tracking cookie (Firefox: default) (Cookie, nothing done)

LinkSynergy: Tracking cookie (Firefox: default) (Cookie, nothing done)

--- Spybot - Search & Destroy version: 1.6.0 (build: 20080707) ---

2008-07-07 blindman.exe (1.0.0.8)

2008-07-07 SDMain.exe (1.0.0.6)

2008-07-07 SDShred.exe (1.0.2.3)

2008-07-07 SDUpdate.exe (1.6.0.8)

2008-07-07 SDWinSec.exe (1.0.0.12)

2008-07-07 SpybotSD.exe (1.6.0.30)

2008-09-16 TeaTimer.exe (1.6.3.25)

2008-11-22 unins000.exe (51.49.0.0)

2008-07-07 Update.exe (1.6.0.7)

2008-10-22 advcheck.dll (1.6.2.13)

2007-04-02 aports.dll (2.1.0.0)

2008-06-14 DelZip179.dll (1.79.11.1)

2008-09-15 SDHelper.dll (1.6.2.14)

2008-06-19 sqlite3.dll

2008-10-22 Tools.dll (2.1.6.8)

2008-11-04 Includes\Adware.sbi (*)

2008-11-25 Includes\AdwareC.sbi (*)

2008-06-03 Includes\Cookies.sbi (*)

2008-09-02 Includes\Dialer.sbi (*)

2008-09-09 Includes\DialerC.sbi (*)

2008-07-23 Includes\HeavyDuty.sbi (*)

2008-11-18 Includes\Hijackers.sbi (*)

2008-11-18 Includes\HijackersC.sbi (*)

2008-09-09 Includes\Keyloggers.sbi (*)

2008-11-18 Includes\KeyloggersC.sbi (*)

2004-11-29 Includes\LSP.sbi (*)

2008-11-18 Includes\Malware.sbi (*)

2008-12-03 Includes\MalwareC.sbi (*)

2008-11-03 Includes\PUPS.sbi (*)

2008-12-02 Includes\PUPSC.sbi (*)

2007-11-07 Includes\Revision.sbi (*)

2008-06-18 Includes\Security.sbi (*)

2008-12-02 Includes\SecurityC.sbi (*)

2008-06-03 Includes\Spybots.sbi (*)

2008-06-03 Includes\SpybotsC.sbi (*)

2008-11-04 Includes\Spyware.sbi (*)

2008-12-02 Includes\SpywareC.sbi (*)

2008-06-03 Includes\Tracks.uti

2008-11-04 Includes\Trojans.sbi (*)

2008-12-02 Includes\TrojansC.sbi (*)

2008-03-04 Plugins\Chai.dll

2008-03-05 Plugins\Fennel.dll

2008-02-26 Plugins\Mate.dll

2007-12-24 Plugins\TCPIPAddress.dll

--- System information ---

Windows XP (Build: 2600) Service Pack 3 (5.1.2600)

/ .NETFramework / 1.1: Microsoft .NET Framework 1.1 Hotfix (KB928366)

/ .NETFramework / 1.1: Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)

/ MSXML4SP2: FIX: ASP stops responding when calling Response.Redirect to another server using msxml4 sp2

/ MSXML4SP2: Security update for MSXML4 SP2 (KB936181)

/ MSXML4SP2: Security update for MSXML4 SP2 (KB954430)

/ Step By Step Interactive Training / SP2: Security Update for Step By Step Interactive Training (KB898458)

/ Step By Step Interactive Training / SP2: Security Update for Step By Step Interactive Training (KB923723)

/ Windows / SP1: Microsoft Internationalized Domain Names Mitigation APIs

/ Windows / SP1: Microsoft National Language Support Downlevel APIs

/ Windows Media Player 10: Security Update for Windows Media Player 10 (KB917734)

/ Windows Media Player 10: Security Update for Windows Media Player 10 (KB936782)

/ Windows Media Player 6.4: Security Update for Windows Media Player 6.4 (KB925398)

/ Windows XP: Security Update for Windows XP (KB923689)

/ Windows XP: Security Update for Windows XP (KB941569)

/ Windows XP / SP0: Security Update for Windows Internet Explorer 7 (KB938127)

/ Windows XP / SP0: Security Update for Windows Internet Explorer 7 (KB944533)

/ Windows XP / SP0: Hotfix for Windows Internet Explorer 7 (KB947864)

/ Windows XP / SP0: Security Update for Windows Internet Explorer 7 (KB950759)

/ Windows XP / SP0: Security Update for Windows Internet Explorer 7 (KB953838)

/ Windows XP / SP0: Security Update for Windows Internet Explorer 7 (KB956390)

/ Windows XP / SP3: Windows XP Service Pack 3

/ Windows XP / SP4: Security Update for Windows XP (KB938464)

/ Windows XP / SP4: Security Update for Windows XP (KB946648)

/ Windows XP / SP4: Security Update for Windows XP (KB950760)

/ Windows XP / SP4: Security Update for Windows XP (KB950762)

/ Windows XP / SP4: Security Update for Windows XP (KB950974)

/ Windows XP / SP4: Security Update for Windows XP (KB951066)

/ Windows XP / SP4: Update for Windows XP (KB951072-v2)

/ Windows XP / SP4: Security Update for Windows XP (KB951376)

/ Windows XP / SP4: Security Update for Windows XP (KB951376-v2)

/ Windows XP / SP4: Security Update for Windows XP (KB951698)

/ Windows XP / SP4: Security Update for Windows XP (KB951748)

/ Windows XP / SP4: Update for Windows XP (KB951978)

/ Windows XP / SP4: Hotfix for Windows XP (KB952287)

/ Windows XP / SP4: Security Update for Windows XP (KB952954)

/ Windows XP / SP4: Security Update for Windows XP (KB953839)

/ Windows XP / SP4: Security Update for Windows XP (KB954211)

/ Windows XP / SP4: Security Update for Windows XP (KB954459)

/ Windows XP / SP4: Security Update for Windows XP (KB955069)

/ Windows XP / SP4: Security Update for Windows XP (KB956391)

/ Windows XP / SP4: Security Update for Windows XP (KB956803)

/ Windows XP / SP4: Security Update for Windows XP (KB956841)

/ Windows XP / SP4: Security Update for Windows XP (KB957095)

/ Windows XP / SP4: Security Update for Windows XP (KB957097)

/ Windows XP / SP4: Security Update for Windows XP (KB958644)

--- Startup entries list ---

Located: HK_LM:Run,

command:

file:

size: 0

MD5: D41D8CD98F00B204E9800998ECF8427E

Warning: if the file is actually larger than 0 bytes,

the checksum could not be properly calculated!

Located: HK_LM:Run, Alcmtr

command: ALCMTR.EXE

file: C:\WINDOWS\ALCMTR.EXE

size: 69632

MD5: 8B4CBBA1EA526830C7F97E7822E2493A

Located: HK_LM:Run, Apoint

command: C:\Program Files\Apoint2K\Apoint.exe

file: C:\Program Files\Apoint2K\Apoint.exe

size: 196608

MD5: 8EBBF7E508EC363BD6933809D17A43A7

Located: HK_LM:Run, avgnt

command: "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min

file: C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe

size: 266497

MD5: 6E812818306D460D62B4ABEA9FDC6679

Located: HK_LM:Run, CeEKEY

command: C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe

file: C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe

size: 651264

MD5: 2E0524F31E6D8315B71AC0681BAEA1A0

Located: HK_LM:Run, CFSServ.exe

command: CFSServ.exe -NoClient

file: CFSServ.exe

size: 0

MD5: D41D8CD98F00B204E9800998ECF8427E

Warning: if the file is actually larger than 0 bytes,

the checksum could not be properly calculated!

Located: HK_LM:Run, DDWMon

command: C:\Program Files\TOSHIBA\TOSHIBA Direct Disc Writer\\ddwmon.exe

file: C:\Program Files\TOSHIBA\TOSHIBA Direct Disc Writer\\ddwmon.exe

size: 495616

MD5: 8A9350D8E866D162104D7A16F03D538D

Located: HK_LM:Run, HotKeysCmds

command: C:\WINDOWS\system32\hkcmd.exe

file: C:\WINDOWS\system32\hkcmd.exe

size: 162584

MD5: E1997E3312A591649AE8A456A5658D0E

Located: HK_LM:Run, HWSetup

command: C:\Program Files\TOSHIBA\TOSHIBA Applet\HWSetup.exe hwSetUP

file: C:\Program Files\TOSHIBA\TOSHIBA Applet\HWSetup.exe

size: 28672

MD5: A9701AB3582D15AF6F92B97DD0163AB6

Located: HK_LM:Run, IgfxTray

command: C:\WINDOWS\system32\igfxtray.exe

file: C:\WINDOWS\system32\igfxtray.exe

size: 142104

MD5: F94F81840A057E6998DDBF55EECD2C0B

Located: HK_LM:Run, NDSTray.exe

command: NDSTray.exe

file: NDSTray.exe

size: 0

MD5: D41D8CD98F00B204E9800998ECF8427E

Warning: if the file is actually larger than 0 bytes,

the checksum could not be properly calculated!

Located: HK_LM:Run, Persistence

command: C:\WINDOWS\system32\igfxpers.exe

file: C:\WINDOWS\system32\igfxpers.exe

size: 138008

MD5: E907D015172A1B80A89D5B6B55C83A7E

Located: HK_LM:Run, RTHDCPL

command: RTHDCPL.EXE

file: C:\WINDOWS\RTHDCPL.EXE

size: 16377344

MD5: 3A57538B12DE39F723BEE00E4A72FC4A

Located: HK_LM:Run, SmoothView

command: C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe

file: C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe

size: 143360

MD5: D96EF52E211FFE5390BC13039F23CC29

Located: HK_LM:Run, SVPWUTIL

command: C:\Program Files\Toshiba\Windows Utilities\SVPWUTIL.exe SVPwUTIL

file: C:\Program Files\Toshiba\Windows Utilities\SVPWUTIL.exe

size: 65536

MD5: 62ADD2BF01685E4269B2298BA54E3EF6

Located: HK_LM:Run, TCtryIOHook

command: TCtrlIOHook.exe

file: C:\WINDOWS\system32\TCtrlIOHook.exe

size: 28672

MD5: 93E9E2F7E303C6C85F162D1D2E6AA67B

Located: HK_LM:Run, TDispVol

command: TDispVol.exe

file: C:\WINDOWS\system32\TDispVol.exe

size: 73728

MD5: D6F801AFF5D095BF11FFB40EC4A75522

Located: HK_LM:Run, TFncKy

command: TFncKy.exe

file: TFncKy.exe

size: 0

MD5: D41D8CD98F00B204E9800998ECF8427E

Warning: if the file is actually larger than 0 bytes,

the checksum could not be properly calculated!

Located: HK_LM:Run, topi

command: C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe -startup

file: C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe

size: 581632

MD5: E1FAAF7915BC07352CCF1DFF37058414

Located: HK_LM:Run, TPNF

command: C:\Program Files\TOSHIBA\TouchPad\TPTray.exe

file: C:\Program Files\TOSHIBA\TouchPad\TPTray.exe

size: 53248

MD5: 7B4D848550D7E1CB8881A9BEF1DACE2F

Located: HK_LM:Run, TPSMain

command: TPSMain.exe

file: C:\WINDOWS\system32\TPSMain.exe

size: 266240

MD5: B6C23E30595780FE0C2AD70A07E59E1C

Located: HK_LM:Run, Zooming

command: ZoomingHook.exe

file: C:\WINDOWS\system32\ZoomingHook.exe

size: 24576

MD5: FD02F46A78C30F6CFF37C7FE37A16CC5

Located: HK_CU:Run, CTFMON.EXE

where: .DEFAULT...

command: C:\WINDOWS\system32\CTFMON.EXE

file: C:\WINDOWS\system32\CTFMON.EXE

size: 15360

MD5: 5F1D5F88303D4A4DBC8E5F97BA967CC3

Located: HK_CU:Run, DWQueuedReporting

where: .DEFAULT...

command: "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t

file: C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe

size: 434528

MD5: 29E177C7BB7343F365F12AD9A8AF4C48

Located: HK_CU:Run, TOSCDSPD

where: PE_C_ADMINISTRATOR...

command: C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe

file: C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe

size: 65536

MD5: 43382739870D196C79454B327077D039

Located: HK_CU:Run, AdobeUpdater

where: S-1-5-21-2409514809-3273457905-3423061011-1008...

command: C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe

file: C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe

size: 0

MD5: D41D8CD98F00B204E9800998ECF8427E

Warning: if the file is actually larger than 0 bytes,

the checksum could not be properly calculated!

Located: HK_CU:Run, ctfmon.exe

where: S-1-5-21-2409514809-3273457905-3423061011-1008...

command: C:\WINDOWS\system32\ctfmon.exe

file: C:\WINDOWS\system32\ctfmon.exe

size: 15360

MD5: 5F1D5F88303D4A4DBC8E5F97BA967CC3

Located: HK_CU:Run, MSMSGS

where: S-1-5-21-2409514809-3273457905-3423061011-1008...

command: "C:\Program Files\Messenger\msmsgs.exe" /background

file: C:\Program Files\Messenger\msmsgs.exe

size: 1695232

MD5: 3E930C641079443D4DE036167A69CAA2

Located: HK_CU:Run, MsnMsgr

where: S-1-5-21-2409514809-3273457905-3423061011-1008...

command: "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background

file: C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe

size: 5724184

MD5: A8972A2F9A744DD5EE0BFE429D767F1C

Located: HK_CU:Run, Picasa Media Detector

where: S-1-5-21-2409514809-3273457905-3423061011-1008...

command: C:\Program Files\Picasa2\PicasaMediaDetector.exe

file: C:\Program Files\Picasa2\PicasaMediaDetector.exe

size: 443968

MD5: EF1ECB9DF42AF6BF7514BB5EBC5C59EC

Located: HK_CU:Run, TOSCDSPD

where: S-1-5-21-2409514809-3273457905-3423061011-1008...

command: C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe

file: C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe

size: 65536

MD5: 43382739870D196C79454B327077D039

Located: HK_CU:Run, VirTrigger

where: S-1-5-21-2409514809-3273457905-3423061011-1008...

command: "C:\Program Files\VirTrigger\VirTrigger.exe"

file: C:\Program Files\VirTrigger\VirTrigger.exe

size: 0

MD5: D41D8CD98F00B204E9800998ECF8427E

Warning: if the file is actually larger than 0 bytes,

the checksum could not be properly calculated!

Located: HK_CU:Run, CTFMON.EXE

where: S-1-5-18...

command: C:\WINDOWS\system32\CTFMON.EXE

file: C:\WINDOWS\system32\CTFMON.EXE

size: 15360

MD5: 5F1D5F88303D4A4DBC8E5F97BA967CC3

Located: HK_CU:Run, DWQueuedReporting

where: S-1-5-18...

command: "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t

file: C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe

size: 434528

MD5: 29E177C7BB7343F365F12AD9A8AF4C48

Located: Startup (common), AutoUpdate Monitor.lnk

where: C:\Documents and Settings\All Users\Start Menu\Programs\Startup...

command: C:\Program Files\Sophos\AutoUpdate\ALMon.exe

file: C:\Program Files\Sophos\AutoUpdate\ALMon.exe

size: 245760

MD5: 4CF38637FADECCCC00013C0711DB3BBA

Located: Startup (user), DigiGuide TV Guide.lnk

where: C:\Documents and Settings\teacher\Start Menu\Programs\Startup...

command: C:\Program Files\utils\DigiGuide TV Guide\Client.exe

file: C:\Program Files\utils\DigiGuide TV Guide\Client.exe

size: 180224

MD5: 0E21708A38D95F1CA3ED92F90BE23F8B

Located: WinLogon, crypt32chain

command: crypt32.dll

file: crypt32.dll

size: 0

MD5: D41D8CD98F00B204E9800998ECF8427E

Warning: if the file is actually larger than 0 bytes,

the checksum could not be properly calculated!

Located: WinLogon, cryptnet

command: cryptnet.dll

file: cryptnet.dll

size: 0

MD5: D41D8CD98F00B204E9800998ECF8427E

Warning: if the file is actually larger than 0 bytes,

the checksum could not be properly calculated!

Located: WinLogon, cscdll

command: cscdll.dll

file: cscdll.dll

size: 0

MD5: D41D8CD98F00B204E9800998ECF8427E

Warning: if the file is actually larger than 0 bytes,

the checksum could not be properly calculated!

Located: WinLogon, dimsntfy

command: %SystemRoot%\System32\dimsntfy.dll

file: %SystemRoot%\System32\dimsntfy.dll

size: 0

MD5: D41D8CD98F00B204E9800998ECF8427E

Warning: if the file is actually larger than 0 bytes,

the checksum could not be properly calculated!

Located: WinLogon, igfxcui

command: igfxdev.dll

file: igfxdev.dll

size: 0

MD5: D41D8CD98F00B204E9800998ECF8427E

Warning: if the file is actually larger than 0 bytes,

the checksum could not be properly calculated!

Located: WinLogon, ScCertProp

command: wlnotify.dll

file: wlnotify.dll

size: 0

MD5: D41D8CD98F00B204E9800998ECF8427E

Warning: if the file is actually larger than 0 bytes,

the checksum could not be properly calculated!

Located: WinLogon, Schedule

command: wlnotify.dll

file: wlnotify.dll

size: 0

MD5: D41D8CD98F00B204E9800998ECF8427E

Warning: if the file is actually larger than 0 bytes,

the checksum could not be properly calculated!

Located: WinLogon, sclgntfy

command: sclgntfy.dll

file: sclgntfy.dll

size: 0

MD5: D41D8CD98F00B204E9800998ECF8427E

Warning: if the file is actually larger than 0 bytes,

the checksum could not be properly calculated!

Located: WinLogon, SensLogn

command: WlNotify.dll

file: WlNotify.dll

size: 0

MD5: D41D8CD98F00B204E9800998ECF8427E

Warning: if the file is actually larger than 0 bytes,

the checksum could not be properly calculated!

Located: WinLogon, termsrv

command: wlnotify.dll

file: wlnotify.dll

size: 0

MD5: D41D8CD98F00B204E9800998ECF8427E

Warning: if the file is actually larger than 0 bytes,

the checksum could not be properly calculated!

Located: WinLogon, WgaLogon

command: WgaLogon.dll

file: WgaLogon.dll

size: 0

MD5: D41D8CD98F00B204E9800998ECF8427E

Warning: if the file is actually larger than 0 bytes,

the checksum could not be properly calculated!

Located: WinLogon, wlballoon

command: wlnotify.dll

file: wlnotify.dll

size: 0

MD5: D41D8CD98F00B204E9800998ECF8427E

Warning: if the file is actually larger than 0 bytes,

the checksum could not be properly calculated!

--- Browser helper object list ---

{39EA7695-B3F2-4C44-A4BC-297ADA8FD235} (Sophos Web Content Scanner)

location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\

BHO name:

CLSID name: Sophos Web Content Scanner

Path: c:\Program Files\Sophos\Sophos Anti-Virus\

Long name: SophosBHO.dll

Short name: SOPHOS~2.DLL

Date (created): 27/11/2008 14:33:56

Date (last access): 10/12/2008 22:13:40

Date (last write): 27/11/2008 14:33:56

Filesize: 240696

Attributes: archive

MD5: CFC3AB2B75A8AF36960597D7F0E00569

CRC32: E36B88F1

Version: 2.4.2.3941

{53707962-6F74-2D53-2644-206D7942484F} (Spybot-S&D IE Protection)

location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\

BHO name:

CLSID name: Spybot-S&D IE Protection

description: Spybot-S&D IE Browser plugin

classification: Legitimate

known filename: SDhelper.dll

info link: http://spybot.eon.net.au/

info source: Patrick M. Kolla

Path: C:\PROGRA~1\SPYBOT~1\

Long name: SDHelper.dll

Short name:

Date (created): 22/11/2008 18:05:14

Date (last access): 10/12/2008 22:21:42

Date (last write): 15/09/2008 14:25:44

Filesize: 1562960

Attributes: readonly hidden sysfile archive

MD5: 35F73F1936BDE91F1B6995510A61E7A8

CRC32: BE6A5D15

Version: 1.6.2.14

{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)

location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\

BHO name:

CLSID name: SSVHelper Class

Path: C:\Program Files\Java\jre1.6.0\bin\

Long name: ssv.dll

Short name:

Date (created): 01/08/2007 10:01:24

Date (last access): 10/12/2008 22:17:38

Date (last write): 01/08/2007 10:01:24

Filesize: 501384

Attributes: archive

MD5: C647547F1BB66FA0BE237CAFC49EA5F9

CRC32: C4215F57

Version: 6.0.0.104

{7E853D72-626A-48EC-A868-BA8D5E23E045} ()

location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\

BHO name:

CLSID name:

{9030D464-4C02-4ABF-8ECC-5164760863C6} (Windows Live Sign-in Helper)

location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\

BHO name:

CLSID name: Windows Live Sign-in Helper

Path: C:\Program Files\Common Files\Microsoft Shared\Windows Live\

Long name: WindowsLiveLogin.dll

Short name: WINDOW~1.DLL

Date (created): 20/09/2007 09:30:18

Date (last access): 10/12/2008 22:14:08

Date (last write): 20/09/2007 09:30:18

Filesize: 328752

Attributes: archive

MD5: 59CF5BF6684AFCF906CADAD39B4214DE

CRC32: C363813C

Version: 4.200.520.1

{BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} (Windows Live Toolbar Helper)

location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\

BHO name:

CLSID name: Windows Live Toolbar Helper

Path: C:\Program Files\Windows Live Toolbar\

Long name: msntb.dll

Short name:

Date (created): 19/10/2007 10:20:48

Date (last access): 10/12/2008 22:17:38

Date (last write): 19/10/2007 10:20:48

Filesize: 546320

Attributes: archive

MD5: CEE1BE1DA21300208D07FBEAE9EA2B51

CRC32: 12446524

Version: 3.1.0.146

--- ActiveX list ---

{6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class)

DPF name:

CLSID name: WUWebControl Class

Installer: C:\WINDOWS\Downloaded Program Files\wuweb.inf

Codebase: http://www.update.microsoft.com/windowsupd...b?1209732486552

description:

classification: Legitimate

known filename: wuweb.dll

info link:

info source: Safer Networking Ltd.

Path: C:\WINDOWS\system32\

Long name: wuweb.dll

Short name:

Date (created): 01/08/2007 09:30:54

Date (last access): 10/12/2008 22:12:20

Date (last write): 16/10/2008 14:13:40

Filesize: 202776

Attributes: archive

MD5: 1865594AFE88C27A127FF4CF492734B0

CRC32: F48FD025

Version: 7.2.6001.788

{8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0)

DPF name: Java Runtime Environment 1.6.0

CLSID name: Java Plug-in 1.6.0

Installer:

Codebase: http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab

description: Sun Java

classification: Legitimate

known filename: %PROGRAM FILES%\JabaSoft\JRE\*\Bin\npjava131.dll

info link:

info source: Patrick M. Kolla

Path: C:\Program Files\Java\jre1.6.0\bin\

Long name: npjpi160.dll

Short name:

Date (created): 01/08/2007 10:01:24

Date (last access): 06/12/2008 19:41:10

Date (last write): 01/08/2007 10:01:24

Filesize: 132744

Attributes: archive

MD5: A0F84B2A1901E47A625FE6E68EF4053E

CRC32: 46A49529

Version: 6.0.0.104

{8FFBE65D-2C9C-4669-84BD-5829DC0B603C} ()

DPF name:

CLSID name:

Installer: C:\WINDOWS\Downloaded Program Files\erma.inf

Codebase: http://fpdownload.macromedia.com/get/flash...t/ultrashim.cab

description:

classification: Open for discussion

known filename:

info link:

info source: Safer Networking Ltd.

{C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class)

DPF name:

CLSID name: MessengerStatsClient Class

Installer:

Codebase: http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab

description:

classification: Legitimate

known filename: MessengerStatsPAClient.dll

info link:

info source: Safer Networking Ltd.

Path: C:\WINDOWS\Downloaded Program Files\

Long name: MessengerStatsPAClient.dll

Short name: MESSEN~1.DLL

Date (created): 22/02/2007 22:41:12

Date (last access): 06/12/2008 19:29:48

Date (last write): 22/02/2007 22:41:12

Filesize: 304544

Attributes: archive

MD5: 8945CCA5FC4F25168E8B6F401EFAF51F

CRC32: 0F12FD23

Version: 9.5.6907.1

{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} (Java Runtime Environment 1.6.0)

DPF name: Java Runtime Environment 1.6.0

CLSID name: Java Plug-in 1.6.0

Installer:

Codebase: http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab

description:

classification: Legitimate

known filename: npjpi160.dll

info link:

info source: Safer Networking Ltd.

Path: C:\Program Files\Java\jre1.6.0\bin\

Long name: npjpi160.dll

Short name:

Date (created): 01/08/2007 10:01:24

Date (last access): 10/12/2008 22:28:18

Date (last write): 01/08/2007 10:01:24

Filesize: 132744

Attributes: archive

MD5: A0F84B2A1901E47A625FE6E68EF4053E

CRC32: 46A49529

Version: 6.0.0.104

{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} (Java Runtime Environment 1.6.0)

DPF name: Java Runtime Environment 1.6.0

CLSID name: Java Plug-in 1.6.0

Installer:

Codebase: http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab

description:

classification: Legitimate

known filename: npjpi150_06.dll

info link:

info source: Safer Networking Ltd.

Path: C:\Program Files\Java\jre1.6.0\bin\

Long name: npjpi160.dll

Short name:

Date (created): 01/08/2007 10:01:24

Date (last access): 10/12/2008 22:28:18

Date (last write): 01/08/2007 10:01:24

Filesize: 132744

Attributes: archive

MD5: A0F84B2A1901E47A625FE6E68EF4053E

CRC32: 46A49529

Version: 6.0.0.104

--- Process list ---

PID: 0 ( 0) [system]

PID: 772 ( 4) \SystemRoot\System32\smss.exe

size: 50688

PID: 824 ( 772) \??\C:\WINDOWS\system32\csrss.exe

size: 6144

PID: 848 ( 772) \??\C:\WINDOWS\system32\winlogon.exe

size: 507904

PID: 892 ( 848) C:\WINDOWS\system32\services.exe

size: 108544

MD5: 0E776ED5F7CC9F94299E70461B7B8185

PID: 904 ( 848) C:\WINDOWS\system32\lsass.exe

size: 13312

MD5: BF2466B3E18E970D8A976FB95FC1CA85

PID: 1076 ( 892) C:\WINDOWS\system32\svchost.exe

size: 14336

MD5: 27C6D03BCDB8CFEB96B716F3D8BE3E18

PID: 1124 ( 892) C:\WINDOWS\system32\svchost.exe

size: 14336

MD5: 27C6D03BCDB8CFEB96B716F3D8BE3E18

PID: 1268 ( 892) C:\WINDOWS\System32\svchost.exe

size: 14336

MD5: 27C6D03BCDB8CFEB96B716F3D8BE3E18

PID: 1312 ( 892) c:\Program Files\Sophos\Sophos Anti-Virus\SavService.exe

size: 98304

MD5: 2E83AD127667AA4E704011F71AA1351B

PID: 1604 (1572) C:\WINDOWS\Explorer.EXE

size: 1033728

MD5: 12896823FB95BFB3DC9B46BCAEDC9923

PID: 1940 ( 892) C:\WINDOWS\system32\svchost.exe

size: 14336

MD5: 27C6D03BCDB8CFEB96B716F3D8BE3E18

PID: 2012 ( 892) C:\WINDOWS\system32\svchost.exe

size: 14336

MD5: 27C6D03BCDB8CFEB96B716F3D8BE3E18

PID: 480 ( 892) C:\WINDOWS\system32\spoolsv.exe

size: 57856

MD5: D8E14A61ACC1D4A6CD0D38AEBAC7FA3B

PID: 532 ( 892) C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

size: 68865

MD5: D6C8942BEA3698A2E7559BD423BFA5D7

PID: 1928 ( 892) C:\WINDOWS\system32\agrsmsvc.exe

size: 9216

MD5: 39E435C90C9C4F780FA0ED05CA3C3A1B

PID: 1948 ( 892) C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

size: 151297

MD5: 335A142923FE7F97E8C8388ACD067568

PID: 1968 ( 892) C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe

size: 30312

MD5: 6163664C7E9CD110AF70180C126C3FDC

PID: 2036 ( 892) C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe

size: 40960

MD5: 3CB0CC8879956C187E87E18634EE5164

PID: 276 ( 892) C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

size: 322120

MD5: 11F714F85530A2BD134074DC30E99FCA

PID: 400 ( 892) c:\Program Files\Sophos\Sophos Anti-Virus\SAVAdminService.exe

size: 69632

MD5: B037FA1C3E09C06381192DF11CDA4AD6

PID: 1992 ( 892) c:\Program Files\Sophos\AutoUpdate\ALsvc.exe

size: 172032

MD5: A2FC88DC4F21C7BB8693955D5E8D3DBB

PID: 792 ( 892) C:\WINDOWS\system32\svchost.exe

size: 14336

MD5: 27C6D03BCDB8CFEB96B716F3D8BE3E18

PID: 684 ( 892) C:\WINDOWS\system32\TODDSrv.exe

size: 114688

MD5: D540858E65BFA6FDED41AD2495ECE344

PID: 1160 ( 892) C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe

size: 125048

MD5: 87843B2DA99051BC66E2D6C211E3D6A4

PID: 1084 ( 892) C:\WINDOWS\system32\wdfmgr.exe

size: 38912

MD5: C81B8635DEE0D3EF5F64B3DD643023A5

PID: 1208 ( 892) C:\Program Files\RealVNC\VNC4\WinVNC4.exe

size: 439632

MD5: F3EDC9909A02E6BCA863EB702D37B505

PID: 2876 (1604) C:\WINDOWS\system32\ctfmon.exe

size: 15360

MD5: 5F1D5F88303D4A4DBC8E5F97BA967CC3

PID: 3020 ( 892) C:\WINDOWS\System32\alg.exe

size: 44544

MD5: 8C515081584A38AA007909CD02020B3D

PID: 3968 (3948) C:\Program Files\Apoint2K\Apntex.exe

size: 45056

MD5: CCA1B81492B40890E44B2B20A780EE1F

PID: 2328 ( 892) C:\WINDOWS\System32\svchost.exe

size: 14336

MD5: 27C6D03BCDB8CFEB96B716F3D8BE3E18

PID: 2964 (3108) C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe

size: 266497

MD5: 6E812818306D460D62B4ABEA9FDC6679

PID: 2568 (3736) C:\Program Files\utils\DigiGuide TV Guide\digiguide.exe

size: 45056

MD5: 5CFBB9FCD1A9038A04C64B99E898648A

PID: 2576 (1604) C:\Program Files\Mozilla Firefox\firefox.exe

size: 307712

MD5: BAC6F7DE724D7F30EBD78648C86B4617

PID: 716 (1604) C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe

size: 4891472

MD5: 3B1B5D09D3C9C4CD39D4DB06ED7A0855

PID: 680 (1268) C:\WINDOWS\system32\wuauclt.exe

size: 51224

MD5: E654B78D2F1D791B30D0ED9A8195EC22

PID: 4 ( 0) System

--- Browser start & search pages list ---

Spybot - Search & Destroy browser pages report, 10/12/2008 22:28:17

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchURL

http://www.google.com/

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Local Page

C:\WINDOWS\system32\blank.htm

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Search Page

http://www.google.com/

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Search Bar

http://www.google.com/

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page

http://www.yahoo.co.uk/

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Default_Search_URL

http://www.google.com/

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search\SearchAssistant

http://www.google.com/

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl\@

http://www.google.com/search?q=%s

HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchURL

http://www.google.com/

HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Local Page

%SystemRoot%\system32\blank.htm

HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Search Page

http://go.microsoft.com/fwlink/?LinkId=54896

HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Search Bar

http://www.google.com/

HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Start Page

http://go.microsoft.com/fwlink/?LinkId=69157

HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Default_Page_URL

http://go.microsoft.com/fwlink/?LinkId=69157

HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Default_Search_URL

http://go.microsoft.com/fwlink/?LinkId=54896

HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search\SearchAssistant

http://www.google.com/

HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search\CustomizeSearch

http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm

--- Winsock Layered Service Provider list ---

Protocol 0: MSAFD Tcpip [TCP/IP]

GUID: {E70F1AA0-AB8B-11CF-8CA3-00805F48A192}

Filename: %SystemRoot%\system32\mswsock.dll

Description: Microsoft Windows NT/2k/XP IP protocol

DB filename: %SystemRoot%\system32\mswsock.dll

DB protocol: MSAFD Tcpip [*]

Protocol 1: MSAFD Tcpip [uDP/IP]

GUID: {E70F1AA0-AB8B-11CF-8CA3-00805F48A192}

Filename: %SystemRoot%\system32\mswsock.dll

Description: Microsoft Windows NT/2k/XP IP protocol

DB filename: %SystemRoot%\system32\mswsock.dll

DB protocol: MSAFD Tcpip [*]

Protocol 2: MSAFD Tcpip [RAW/IP]

GUID: {E70F1AA0-AB8B-11CF-8CA3-00805F48A192}

Filename: %SystemRoot%\system32\mswsock.dll

Description: Microsoft Windows NT/2k/XP IP protocol

DB filename: %SystemRoot%\system32\mswsock.dll

DB protocol: MSAFD Tcpip [*]

Protocol 3: RSVP UDP Service Provider

GUID: {9D60A9E0-337A-11D0-BD88-0000C082E69A}

Filename: %SystemRoot%\system32\rsvpsp.dll

Description: Microsoft Windows NT/2k/XP RVSP

DB filename: %SystemRoot%\system32\rsvpsp.dll

DB protocol: RSVP * Service Provider

Protocol 4: RSVP TCP Service Provider

GUID: {9D60A9E0-337A-11D0-BD88-0000C082E69A}

Filename: %SystemRoot%\system32\rsvpsp.dll

Description: Microsoft Windows NT/2k/XP RVSP

DB filename: %SystemRoot%\system32\rsvpsp.dll

DB protocol: RSVP * Service Provider

Protocol 5: MSAFD NetBIOS [\Device\NetBT_Tcpip_{89B65663-9D04-483B-824F-32036D43801A}] SEQPACKET 5

GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}

Filename: %SystemRoot%\system32\mswsock.dll

Description: Microsoft Windows NT/2k/XP NetBios protocol

DB filename: %SystemRoot%\system32\mswsock.dll

DB protocol: MSAFD NetBIOS *

Protocol 6: MSAFD NetBIOS [\Device\NetBT_Tcpip_{89B65663-9D04-483B-824F-32036D43801A}] DATAGRAM 5

GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}

Filename: %SystemRoot%\system32\mswsock.dll

Description: Microsoft Windows NT/2k/XP NetBios protocol

DB filename: %SystemRoot%\system32\mswsock.dll

DB protocol: MSAFD NetBIOS *

Protocol 7: MSAFD NetBIOS [\Device\NetBT_Tcpip_{67D10E51-B4DA-4E19-8724-061323186BDB}] SEQPACKET 4

GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}

Filename: %SystemRoot%\system32\mswsock.dll

Description: Microsoft Windows NT/2k/XP NetBios protocol

DB filename: %SystemRoot%\system32\mswsock.dll

DB protocol: MSAFD NetBIOS *

Protocol 8: MSAFD NetBIOS [\Device\NetBT_Tcpip_{67D10E51-B4DA-4E19-8724-061323186BDB}] DATAGRAM 4

GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}

Filename: %SystemRoot%\system32\mswsock.dll

Description: Microsoft Windows NT/2k/XP NetBios protocol

DB filename: %SystemRoot%\system32\mswsock.dll

DB protocol: MSAFD NetBIOS *

Protocol 9: MSAFD NetBIOS [\Device\NetBT_Tcpip_{55024CCA-8895-4B5E-92EE-4954C13D3283}] SEQPACKET 0

GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}

Filename: %SystemRoot%\system32\mswsock.dll

Description: Microsoft Windows NT/2k/XP NetBios protocol

DB filename: %SystemRoot%\system32\mswsock.dll

DB protocol: MSAFD NetBIOS *

Protocol 10: MSAFD NetBIOS [\Device\NetBT_Tcpip_{55024CCA-8895-4B5E-92EE-4954C13D3283}] DATAGRAM 0

GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}

Filename: %SystemRoot%\system32\mswsock.dll

Description: Microsoft Windows NT/2k/XP NetBios protocol

DB filename: %SystemRoot%\system32\mswsock.dll

DB protocol: MSAFD NetBIOS *

Protocol 11: MSAFD NetBIOS [\Device\NetBT_Tcpip_{11C3A07F-387A-48C8-BAD5-710A153D0EAF}] SEQPACKET 1

GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}

Filename: %SystemRoot%\system32\mswsock.dll

Description: Microsoft Windows NT/2k/XP NetBios protocol

DB filename: %SystemRoot%\system32\mswsock.dll

DB protocol: MSAFD NetBIOS *

Protocol 12: MSAFD NetBIOS [\Device\NetBT_Tcpip_{11C3A07F-387A-48C8-BAD5-710A153D0EAF}] DATAGRAM 1

GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}

Filename: %SystemRoot%\system32\mswsock.dll

Description: Microsoft Windows NT/2k/XP NetBios protocol

DB filename: %SystemRoot%\system32\mswsock.dll

DB protocol: MSAFD NetBIOS *

Protocol 13: MSAFD NetBIOS [\Device\NetBT_Tcpip_{5E8CF3A9-9A25-47C5-A0C3-82539AF95034}] SEQPACKET 2

GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}

Filename: %SystemRoot%\system32\mswsock.dll

Description: Microsoft Windows NT/2k/XP NetBios protocol

DB filename: %SystemRoot%\system32\mswsock.dll

DB protocol: MSAFD NetBIOS *

Protocol 14: MSAFD NetBIOS [\Device\NetBT_Tcpip_{5E8CF3A9-9A25-47C5-A0C3-82539AF95034}] DATAGRAM 2

GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}

Filename: %SystemRoot%\system32\mswsock.dll

Description: Microsoft Windows NT/2k/XP NetBios protocol

DB filename: %SystemRoot%\system32\mswsock.dll

DB protocol: MSAFD NetBIOS *

Protocol 15: MSAFD NetBIOS [\Device\NetBT_Tcpip_{EFCC6C54-FB7D-4412-A07C-DD9FC71F35ED}] SEQPACKET 3

GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}

Filename: %SystemRoot%\system32\mswsock.dll

Description: Microsoft Windows NT/2k/XP NetBios protocol

DB filename: %SystemRoot%\system32\mswsock.dll

DB protocol: MSAFD NetBIOS *

Protocol 16: MSAFD NetBIOS [\Device\NetBT_Tcpip_{EFCC6C54-FB7D-4412-A07C-DD9FC71F35ED}] DATAGRAM 3

GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}

Filename: %SystemRoot%\system32\mswsock.dll

Description: Microsoft Windows NT/2k/XP NetBios protocol

DB filename: %SystemRoot%\system32\mswsock.dll

DB protocol: MSAFD NetBIOS *

Namespace Provider 0: Tcpip

GUID: {22059D40-7E9E-11CF-AE5A-00AA00A7112B}

Filename: %SystemRoot%\System32\mswsock.dll

Description: Microsoft Windows NT/2k/XP TCP/IP name space provider

DB filename: %SystemRoot%\system32\mswsock.dll

DB protocol: TCP/IP

Namespace Provider 1: NTDS

GUID: {3B2637EE-E580-11CF-A555-00C04FD8D4AC}

Filename: %SystemRoot%\System32\winrnr.dll

Description: Microsoft Windows NT/2k/XP name space provider

DB filename: %SystemRoot%\system32\winrnr.dll

DB protocol: NTDS

Namespace Provider 2: Network Location Awareness (NLA) Namespace

GUID: {6642243A-3BA8-4AA6-BAA5-2E0BD71FDD83}

Filename: %SystemRoot%\System32\mswsock.dll

Description: Microsoft Windows NT/2k/XP name space provider

DB filename: %SystemRoot%\system32\mswsock.dll

DB protocol: NLA-Namespace

I am only able to use firefox as my browser & can't access my MSN or use internet Explorer still.

Tigger93 · December 10, 2008

Those are all tracking cookies, nothing to worry about.

Can you please post a HijackThis log?

wes · December 11, 2008

Those are all tracking cookies, nothing to worry about.
Can you please post a HijackThis log?

Thanks for that!

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 18:08:29, on 11/12/2008

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16762)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

C:\WINDOWS\system32\agrsmsvc.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe

C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

c:\Program Files\Sophos\Sophos Anti-Virus\SAVAdminService.exe

c:\Program Files\Sophos\AutoUpdate\ALsvc.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\TODDSrv.exe

C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe

C:\Program Files\RealVNC\VNC4\WinVNC4.exe

C:\WINDOWS\system32\hkcmd.exe

C:\WINDOWS\system32\igfxpers.exe

C:\WINDOWS\system32\igfxsrvc.exe

C:\WINDOWS\RTHDCPL.EXE

C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe

C:\Program Files\TOSHIBA\TouchPad\TPTray.exe

C:\WINDOWS\system32\TCtrlIOHook.exe

C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe

C:\WINDOWS\system32\TDispVol.exe

C:\WINDOWS\system32\TPSMain.exe

C:\WINDOWS\system32\ZoomingHook.exe

C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe

C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe

C:\Program Files\TOSHIBA\TOSHIBA Direct Disc Writer\ddwmon.exe

C:\Program Files\Apoint2K\Apoint.exe

C:\Program Files\TOSHIBA\ConfigFree\CFSServ.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe

C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Picasa2\PicasaMediaDetector.exe

C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe

C:\Program Files\Messenger\msmsgs.exe

C:\WINDOWS\system32\TPSBattM.exe

C:\Program Files\Sophos\AutoUpdate\ALMon.exe

C:\Program Files\Apoint2K\Apntex.exe

C:\Program Files\utils\DigiGuide TV Guide\digiguide.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.co.uk/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896