I don't know what the problem is...

  1. 11-09-2006  #1
    mattzor D-A-L Guest

    I don't know what the problem is...

    worm.locksky.ao related? ewido can't remove that for some reason. Also, whatever it is seems to disable the transparent highlight of my desktop icons and removes my quicklaunch bar...

    log:

    Logfile of HijackThis v1.99.1
    Scan saved at 8:18:01 PM, on 9/10/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\WLTRYSVC.EXE
    C:\WINDOWS\System32\bcmwltry.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\ewido anti-spyware 4.0\guard.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\WLTRAY.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\Apoint\Apoint.exe
    C:\Program Files\Apoint\HidFind.exe
    C:\Program Files\Apoint\Apntex.exe
    C:\WINDOWS\stsystra.exe
    C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe
    C:\WINDOWS\win3211-1796772982.exe
    C:\program files\popupwithcast\septpop06apsept.exe
    C:\WINDOWS\sachostx.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\sachostc.exe
    C:\WINDOWS\system32\sachosts.exe
    C:\Program Files\ewido anti-spyware 4.0\ewido.exe
    C:\Documents and Settings\Matt McDaniel\Desktop\HijackThis.exe

    F2 - REG:system.ini: UserInit=userinit.exe
    O1 - Hosts: 66.98.136.25 auto.search.msn.com
    O1 - Hosts: 66.98.136.25 auto.search.msn.es
    O1 - Hosts: 66.98.136.25 auto.search.msn.com
    O1 - Hosts: 66.98.136.25 auto.search.msn.es
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSL encrypt - {746455FE-D059-47e7-AF0E-140E03F5A447} - C:\WINDOWS\system32\nsn10.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
    O2 - BHO: (no name) - {9D3DE6D7-5F6E-72C0-45F2-73E2987477E3} - C:\WINDOWS\system32\vas.dll (file missing)
    O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
    O4 - HKLM\..\Run: [NVHotkey] rundll32.exe nvHotkey.dll,Start
    O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
    O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
    O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe"
    O4 - HKLM\..\Run: [win3211-1796772982] C:\WINDOWS\win3211-1796772982.exe
    O4 - HKLM\..\Run: [xkg45b53] RUNDLL32.EXE w4928c56.dll,n 00445b4f000000034928c56
    O4 - HKLM\..\Run: [loaddr] C:\DOCUME~1\MATTMC~1\LOCALS~1\Temp\ajdnjhfo10.exe
    O4 - HKLM\..\Run: [septpop06apsept] C:\program files\popupwithcast\septpop06apsept.exe
    O4 - HKLM\..\Run: [SystemLoader] C:\WINDOWS\sysldr32.exe
    O4 - HKLM\..\Run: [sachost] C:\WINDOWS\sachostx.exe
    O4 - HKLM\..\Run: [adstart] "iexplore.exe" "http://iesettingsupdate"
    O4 - HKLM\..\Run: [ExploreUpdSched] C:\WINDOWS\system32\pwinppex.exe GEN001
    O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
    O4 - HKCU\..\Run: [cprocsvc] C:\WINDOWS\system32\crunner\cproc.exe
    O4 - HKCU\..\Run: [PSLister] "C:\Program Files\PSLister\PSLister.exe"
    O4 - HKCU\..\Run: [Winsvr] C:\DOCUME~1\MATTMC~1\LOCALS~1\Temp\stdrun135632.ex e
    O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Startup: TA_Start.lnk = C:\TIGEN001.exe
    O4 - Startup: Think-Adz.lnk = C:\WINDOWS\system32\pwinppex.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O15 - Trusted Zone: *.elitemediagroup.net
    O15 - Trusted Zone: *.media-motor.net
    O15 - Trusted Zone: *.mmohsix.com
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

    ANY help would be really ... helpful. Thanks!!
    Last edited by mattzor; 11-09-2006 at 02:22 AM. Reason: added a thank you XD
  2. 11-09-2006  #2
    VopThis
    VopThis is offline Senior Member (Canada)
    You have several worms and many interrelated infection components.


    Please exit SpySweeper (right-click on icon in tooltray) before running the following procedures listed below:


    Download deldomains:
    http://www.mvps.org/winhelp2002/DelDomains.inf
    When you click on the link, select Save. Save it to your desktop. Once on the desktop: It appears as an icon that looks like a notebook tablet with a gear overlaid on it.


    To use: right-click and select: Install (no need to restart)
    Note: This will remove all entries in the "Trusted Zone" and "Ranges" also.


    Note: Because this will remove all entries in both the Trusted Zone and the Restricted Zone, any program, tool, or settings that were previously used to set restrictions will need to be reset:
    Examples: (if these are being used),
    • Spybot's "Immunize" feature is affected, you will need to re-immunize
    • SpywareBlaster's "Enable all protection" feature will have to be re-enabled
    • IE-SPYADS will have to be reinstalled



    Get hoster here:
    http://www.funkytoad.com/download/hoster.zip
    • Unzip it to a convenient place and run the program.
    • If you see in the top BOX (Editing Tools) ‘Your Hosts file is editable’ then press the ‘Restore Microsoft’s Original Hosts File’ button (in the Backup and Restore Tools BOX) and OK.
    • If you see red text (‘Hosts file is marked as read only’) then press the ‘Make Hosts Writeable’ button - then the Restore Original Hosts button and OK.
    • Close the program.






    SELECT HijackThis FIX ITEMS: Scan with HijackThis and place a check next to these items:

    O2 - BHO: SSL encrypt - {746455FE-D059-47e7-AF0E-140E03F5A447} - C:\WINDOWS\system32\nsn10.dll
    O2 - BHO: (no name) - {9D3DE6D7-5F6E-72C0-45F2-73E2987477E3} - C:\WINDOWS\system32\vas.dll (file missing)

    O4 - HKLM\..\Run: [WIN3211-1796772982] C:\WINDOWS\win3211-1796772982.exe
    O4 - HKLM\..\Run: [XKG45B53] RUNDLL32.EXE w4928c56.dll,n 00445b4f000000034928c56
    O4 - HKLM\..\Run: [loaddr] C:\DOCUME~1\MATTMC~1\LOCALS~1\TEMP\ajdnjhfo10.exe
    O4 - HKLM\..\Run: [SEPTPOP06APSEPT] C:\program files\popupwithcast\septpop06apsept.exe
    O4 - HKLM\..\Run: [SYSTEMLOADER] C:\WINDOWS\sysldr32.exe
    O4 - HKLM\..\Run: [SACHOST] C:\WINDOWS\sachostx.exe
    O4 - HKLM\..\Run: [ADSTART] "iexplore.exe" "http://iesettingsupdate"
    O4 - HKLM\..\Run: [EXPLOREUPDSCHED] C:\WINDOWS\system32\pwinppex.exe GEN001
    O4 - HKCU\..\Run: [CPROCSVC] C:\WINDOWS\system32\crunner\cproc.exe
    O4 - HKCU\..\Run: [PSLISTER] "C:\Program Files\PSLister\PSLister.exe"
    O4 - HKCU\..\Run: [Winsvr] C:\DOCUME~1\MATTMC~1\LOCALS~1\TEMP\stdrun135632.ex e
    O4 - Startup: TA_Start.lnk = C:\TIGEN001.exe
    O4 - Startup: Think-Adz.lnk = C:\WINDOWS\system32\pwinppex.exe

    Make sure that all browser windows and internet links are closed, even this one!
    CLICK ’FIX CHECKED’ with HijackThis.




    1) Please download the Killbox.
    Unzip it to the desktop and run it.

    2) Select "Delete on Reboot".
    3) Then Click the "All Files" button.

    4) Copy the file names below to the clipboard by highlighting them and pressing Control-C:

    C:\WINDOWS\system32\nsn10.dll
    C:\WINDOWS\win3211-1796772982.exe
    C:\DOCUME~1\MATTMC~1\LOCALS~1\TEMP\ajdnjhfo10.exe
    C:\program files\popupwithcast\septpop06apsept.exe
    C:\WINDOWS\sysldr32.exe
    C:\WINDOWS\sachostx.exe
    C:\WINDOWS\system32\sachostc.exe
    C:\WINDOWS\system32\sachosts.exe
    C:\WINDOWS\system32\pwinppex.exe
    C:\WINDOWS\system32\crunner\cproc.exe
    C:\Program Files\PSLister\PSLister.exe
    C:\DOCUME~1\MATTMC~1\LOCALS~1\TEMP\stdrun135632.ex e
    C:\TIGEN001.exe
    5) Return to Killbox, go to the File menu, and choose "Paste from Clipboard".

    6) Click the red-and-white "Delete File" button. Click "Yes" at the Delete on Reboot prompt. Click "Yes" to reboot next.




    POST A REVISED HIJACKTHIS LOG for review:
    Post a new HijackThis log with any feedback as appropriate - how things are now behaving: any new or remaining apparent issues.
  3. 11-09-2006  #3
    mattzor D-A-L Guest
    I don't *notice* any more problems... Here's the log:

    Logfile of HijackThis v1.99.1
    Scan saved at 4:18:16 PM, on 9/11/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\WLTRYSVC.EXE
    C:\WINDOWS\System32\bcmwltry.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\ewido anti-spyware 4.0\guard.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\WLTRAY.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\Apoint\Apoint.exe
    C:\Program Files\Google\Gmail Notifier\gnotify.exe
    C:\WINDOWS\stsystra.exe
    C:\Program Files\Apoint\HidFind.exe
    C:\Program Files\Apoint\Apntex.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe
    C:\Program Files\ewido anti-spyware 4.0\ewido.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Gaim\gaim.exe
    C:\Documents and Settings\Matt McDaniel\Desktop\HijackThis.exe

    F2 - REG:system.ini: UserInit=userinit.exe
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: (no name) - {746455FE-D059-47e7-AF0E-140E03F5A447} - (no file)
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
    O2 - BHO: (no name) - {9D3DE6D7-5F6E-72C0-45F2-73E2987477E3} - (no file)
    O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
    O4 - HKLM\..\Run: [NVHotkey] rundll32.exe nvHotkey.dll,Start
    O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
    O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
    O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe"
    O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
    O4 - HKLM\..\Run: [SystemLoader] C:\WINDOWS\sysldr32.exe
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE



    Thanks so much for the help!! XD

    OH! The one thing I have noticed is that the nameplates under the shortcuts on my desktop have become opaque and are matching the color of my desktop behind my wallpaper... I don't know how to restore them to their old transparent state... Anything?
    //just fixed this...
    Last edited by mattzor; 11-09-2006 at 10:27 PM.
  4. 11-09-2006  #4
    VopThis
    VopThis is offline Senior Member (Canada)
    There are still three (3) residual entries that remain.


    Clean out TEMPORARY FILES:
    To clean your temp folder, recycle bin, etc..please download this free tool:

    CCleaner http://www.ccleaner.com/downloadbuilds.asp

    Install Options:
    • Don't install any Toolbars, or other programs, should it ask you!
    • Just uncheck the option of installing the Yahoo toolbar.

    It will put a shortcut on your Desktop.

    Select the ‘Cleaner’ BUTTON option (top LEFT), if not already selected. Use the ’Windows’ TAB up front by default.
    • Uncheck ‘Cookies’ option (advisable)
    • Optionally, Uncheck ‘Recently Typed URLs’ option (potentially still useful)
    • Click the ‘Analyse’ button.
    • Thereafter, click ‘Run Cleaner’ after you have reviewed what it proposes to clean.



    Forgot to mention:

    You are not running HijackThis (HJT) from a desired location. You really need to setup a dedicated folder for HJT items – to avoid horrible clutter and/or potential lost backup issues.

    It's best that the HijackThis tool NOT be located in its current location (particularly on your Desktop or in a TEMP folder). This way you can more easily undo any changes if something goes wrong.
    • Create a new folder in your C: Drive.
    • Name the FOLDER HijackThis (or HJT) such as C:\Program Files\HijackThis or C:\HJT and move the HijackThis.exe file into it.
    • Run HJT from there (and revise your shortcut accordingly).




    SELECT HijackThis FIX ITEMS: Scan with HijackThis and place a check next to these items:

    F2 - REG:system.ini: UserInit=userinit.exe

    O2 - BHO: (no name) - {746455FE-D059-47e7-AF0E-140E03F5A447} - (no file)
    O2 - BHO: (no name) - {9D3DE6D7-5F6E-72C0-45F2-73E2987477E3} - (no file)

    O4 - HKLM\..\Run: [SYSTEMLOADER] C:\WINDOWS\sysldr32.exe

    Make sure that all browser windows and internet links are closed, even this one!
    CLICK ’FIX CHECKED’ with HijackThis.



    Reboot and post your latest HijackThis LOG.
  5. 12-09-2006  #5
    mattzor D-A-L Guest
    new log:

    Logfile of HijackThis v1.99.1
    Scan saved at 6:18:16 PM, on 9/11/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\WLTRYSVC.EXE
    C:\WINDOWS\System32\bcmwltry.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\ewido anti-spyware 4.0\guard.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\WLTRAY.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\Apoint\Apoint.exe
    C:\Program Files\Google\Gmail Notifier\gnotify.exe
    C:\WINDOWS\stsystra.exe
    C:\Program Files\Apoint\HidFind.exe
    C:\Program Files\Apoint\Apntex.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe
    C:\Program Files\ewido anti-spyware 4.0\ewido.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Gaim\gaim.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\NOTEPAD.EXE
    C:\Program Files\SmartFTP Client 2.0\SmartFTP.exe
    C:\HJT\HijackThis.exe

    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
    O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
    O4 - HKLM\..\Run: [NVHotkey] rundll32.exe nvHotkey.dll,Start
    O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
    O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
    O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe"
    O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
    O4 - HKLM\..\Run: [SystemLoader] C:\WINDOWS\sysldr32.exe
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

    Assuming that all of this is over and done with, which programs should I hold on to and which one's could just be downloaded as needed? I've gotten in the habit of holding on to Ad-Aware but besides that I try to keep my HDD relatively clean. (and I don't mean clean of malware ... obviously >.<)
  6. 12-09-2006  #6
    VopThis
    VopThis is offline Senior Member (Canada)
    O4 - HKLM\..\Run: [SystemLoader] C:\WINDOWS\sysldr32.exe
    The above Trojan item has twice resisted removal - try doing the removal instructions given here:

    http://www.bleepingcomputer.com/star...der-13911.html
  7. 12-09-2006  #7
    mattzor D-A-L Guest
    I ran through the Autoruns process and deleted it from the startup. I went to delete it from the HDD afterwards, like the Sysinternals site instructed but I can't find it on the drive. I made hidden files/folders visible and all that... I still can't find it. What am I doing wrong? Clearly something?

    Thanks for the help. Sorry it's takin' this long...
  8. 12-09-2006  #8
    VopThis
    VopThis is offline Senior Member (Canada)
    Save 20% on AVG Internet Security 2012 Suite!
    Is the HijackThis malware line of interest no longer present? They may have a very clever or tricky reinfection scheme at work here:

    O4 - HKLM\..\Run: [SystemLoader] C:\WINDOWS\sysldr32.exe
+ Reply to Thread
« computer really slow and screen clearing from top to bottom when closing programs | Help!.. Eplorer.exe Runtime error! »