Please check my log ....

Logfile of Trend Micro HijackThis v2.0.0 (BETA) 
Scan saved at 10:42:36 PM, on 12/28/2007 
Platform: Windows XP SP2 (WinNT 5.01.2600) 
Boot mode: Normal

Running processes: 
C:\WINDOWS\System32\smss.exe 
C:\WINDOWS\system32\winlogon.exe 
C:\WINDOWS\system32\services.exe 
C:\WINDOWS\system32\lsass.exe 
C:\WINDOWS\system32\Ati2evxx.exe 
C:\WINDOWS\system32\svchost.exe 
C:\WINDOWS\System32\svchost.exe 
C:\Software & Programs Files\Ad-Aware 2007\aawservice.exe 
C:\WINDOWS\system32\Ati2evxx.exe 
C:\WINDOWS\Explorer.EXE 
C:\WINDOWS\system32\spoolsv.exe 
c:\program files\common files\logishrd\lvmvfm\LVPrcSrv.exe 
C:\WINDOWS\RTHDCPL.EXE 
C:\WINDOWS\ALCMTR.EXE 
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe 
C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe 
C:\Program Files\Common Files\Logitech\LComMgr\LVComSX.exe 
C:\WINDOWS\system32\ctfmon.exe 
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe 
C:\Program Files\LClock\lclock.exe 
C:\Program Files\Vista Sidebar\sidebar.exe 
C:\Program Files\ViStart\ViStart.exe 
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe 
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe 
C:\Software & Programs Files\Diskeeper Pro Premier 2007\DkService.exe 
C:\Software & Programs Files\Ewido Anti-Malware\ewidoguard.exe 
C:\Program Files\Common Files\LightScribe\LSSrvc.exe 
C:\Program Files\MagicTune Premium\MagicTuneEngine.exe 
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE 
C:\WINDOWS\system32\PSIService.exe 
C:\Program Files\CyberLink\Shared Files\RichVideo.exe 
C:\Software & Programs Files\ProShow Gold\ScsiAccess.exe 
C:\WINDOWS\system32\svchost.exe 
C:\WINDOWS\system32\Tablet.exe 
C:\WINDOWS\system32\MsPMSPSv.exe 
C:\Software & Programs Files\Avant Browser\avant.exe 
C:\Documents and Settings\Owner\Desktop\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = <a href="http://www.yahoo.com/">http://www.yahoo.com/</a> 
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = <a href="http://go.microsoft.com/fwlink/?LinkId=69157">http://go.microsoft.com/fwlink/?LinkId=69157</a> 
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = <a href="http://go.microsoft.com/fwlink/?LinkId=54896">http://go.microsoft.com/fwlink/?LinkId=54896</a> 
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = <a href="http://go.microsoft.com/fwlink/?LinkId=54896">http://go.microsoft.com/fwlink/?LinkId=54896</a> 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = <a href="http://go.microsoft.com/fwlink/?LinkId=69157">http://go.microsoft.com/fwlink/?LinkId=69157</a> 
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = <a href="http://go.microsoft.com/fwlink/?LinkId=54843">http://go.microsoft.com/fwlink/?LinkId=54843</a> 
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost 
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) 
O1 - Hosts: 66.98.148.65 auto.search.msn.com 
O1 - Hosts: 66.98.148.65 auto.search.msn.es 
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll 
O2 - BHO: BitComet Helper - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Software & Programs Files\BitComet\tools\BitCometBHO.dll 
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) 
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll 
O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Program Files\Styler\TB\StylerTB.dll 
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE 
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE 
O4 - HKLM\..\Run: [DXDllRegExe] dxdllreg.exe 
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg 
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP 
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" 
O4 - HKLM\..\Run: [LVCOMSX] "C:\Program Files\Common Files\Logitech\LComMgr\LVComSX.exe" 
O4 - HKLM\..\Run: [QuickTime Task] "C:\Software & Programs Files\Quicktime 7\qttask.exe" -atboottime 
O4 - HKLM\..\Run: [Corel Photo Downloader] "C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe" -startup 
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe 
O4 - HKCU\..\Run: [LClock] C:\Program Files\LClock\lclock.exe 
O4 - HKCU\..\Run: [Vista Sidebar] C:\Program Files\Vista Sidebar\sidebar.exe 
O4 - HKCU\..\Run: [ViStart] C:\Program Files\ViStart\ViStart.exe 
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'LOCAL SERVICE') 
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'NETWORK SERVICE') 
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'SYSTEM') 
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'Default user') 
O8 - Extra context menu item: &Search - ?p=ZNxmk546YYFI 
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\SOFTWA~1\OFFICE11\EXCEL.EXE/3000 
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html 
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html 
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html 
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html 
O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Software & Programs Files\BitComet\tools\BitCometBHO_1.1.7.4.dll 
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\SOFTWA~1\MICROS~1\OFFICE11\REFIEBAR.DLL 
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) 
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) 
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - <a href="http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab">http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab</a> 
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll 
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - <a href="http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab">http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab</a> 
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - <a href="http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab">http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab</a> 
O17 - HKLM\System\CCS\Services\Tcpip\..\{4AFC41CA-7E99-4136-98DE-1B536AD7BCB1}: NameServer = 208.67.220.220,208.67.222.222 
O17 - HKLM\System\CCS\Services\Tcpip\..\{59048F65-AD35-44C5-8F34-00037BA6DE8E}: NameServer = 85.255.116.98,85.255.112.237 
O17 - HKLM\System\CCS\Services\Tcpip\..\{D75B6847-1795-4C44-8BF3-73585DFCB7B0}: NameServer = 85.255.116.98,85.255.112.237 
O17 - HKLM\System\CCS\Services\Tcpip\..\{D9956B0D-9D64-4BF1-9DC8-BB7B093152C1}: NameServer = 85.255.116.98,85.255.112.237 
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222 
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222 
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222 
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL 
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll 
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll 
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Software & Programs Files\Ad-Aware 2007\aawservice.exe 
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe 
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe 
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe 
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe 
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe 
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Software & Programs Files\Diskeeper Pro Premier 2007\DkService.exe 
O23 - Service: ewido security suite guard - ewido networks - C:\Software & Programs Files\Ewido Anti-Malware\ewidoguard.exe 
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe 
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe 
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\common files\logishrd\lvmvfm\LVPrcSrv.exe 
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe 
O23 - Service: MagicTuneEngine - Unknown owner - C:\Program Files\MagicTune Premium\MagicTuneEngine.exe 
O23 - Service: MSSQL$PINNACLESYS - Unknown owner - C:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe (file missing) 
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe 
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe 
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe 
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe 
O23 - Service: ScsiAccess - Unknown owner - C:\Software & Programs Files\ProShow Gold\ScsiAccess.exe 
O23 - Service: SQLAgent$PINNACLESYS - Unknown owner - C:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlagent.EXE (file missing) 
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe

-- 
End of file - 10181 bytes

Please check my log ....

Glamdring - 28 December 2007 - 10:44pm

If you cut and paste that log into the box here: 
<a href="http://www.hijackthis.de/index.php?langselect=english">http://www.hijackthis.de/index.php?langselect=english</a> 
click on Analyse then you'll see you have a number of nasties.

Run a full anti spyware and antivirus scan in Safe Mode having turned off System Restore first, then recheck the log and fix any know shouldn't be there.

If in doubt post here again. ;)

pca_nkk - 29 December 2007 - 10:37pm

Hi Glamdring,

Thank´s for the answer. I ´ve have done what you suggested, everything looks ok.

Vino Rosso - 5 January 2008 - 11:46am

Your log shows an infection called Wareout which, given it involves hidden file(s), you'll be lucky to get rid of it by simply fixing HJT entries.

If you haven't got help in another forum, post a fresh log here.

Please check my log ....

Please check my log ....

Please check my log ....

Please check my log ....

Latest Issue

How to...

Speed up Windows XP

Latest Forum topics