System Instability due to Worm.locksky.ao

  1. 18-09-2006  #11
    VopThis
    VopThis is offline Senior Member (Canada)

    Re: System Instability due to Worm.locksky.ao

    Fix the following items in HijackThis and post a revised log:

    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present



    Do a revised combofix scan, if possible.



    Let us see what is loaded on your PC:
    • Run HijackThis and Click ‘Open the Misc Tools section’ button.
    • Then click the ‘Open Uninstall Manager…’ button.
    • Click the ‘Save list…’ button. Save uninstall_list to your desktop.

    • Open the Uninstall list file and post in your next reply please.

  3. 18-09-2006  #12
    zealstarwind
    zealstarwind is offline Newbie
    Just to Recap, I can not get into my normal windows mode due to the fact that It restarts when it runs into a Windows Stop Error, therefor I am running all this in safe mode..

    Here's whatcha asked for and here's whatcha get! still no luck tho, my dad and I are speculating it might be a problem between the bios drivers and some drivers for my video card... which Im unsure if it really is the case... but here it is... also I can get the error that I get when I get my bluescreen of death if you wish...

    ++EDIT++

    well... I think I found the process that's causing the problem, then again it could be a combination of things... I got rid of one problem that was in the rootkit beta, I will grab an error report from it once I run a full scan also, I ended the Dumpprep process and that seemed to help abit, I dunno tho it might be different... Imma restart and see if it starts to do the same thing without ending it, if it pops up
    Attached Files
    Last edited by zealstarwind; 18-09-2006 at 06:43 AM.
  4. 18-09-2006  #13
    zealstarwind
    zealstarwind is offline Newbie
    On a second note.. I couldnt find that log, but some of the problems it found I wrote down before It crashed the first time...

    C:\WINDOWS\System32\IZX32.sys
    C:\WINDOWS\System32\WgaTray.exe
    C:\WINDOWS\System32\userinit.exe
    Before the system shut down I was able to remove the IZX32.sys and restart the computer so when it removed it I thought that was it.. I logged back on and did the rootkit scan which it came up with nothing found, I didnt delete those other two tho so I am definately thinking they were linked, Im going to try to see if it comes back by logging on and off a few times...

    If there's anything you wish for me to do any logs to post with this latest development, by all means I will be happy too *smiles*
  5. 18-09-2006  #14
    VopThis
    VopThis is offline Senior Member (Canada)
    C:\WINDOWS\System32\WgaTray.exe
    If this file size is 822784, it could be a bad file. Otherwise, it should a legitimate file:

    http://fileinfo.prevx.com/filesearch...ch=WgaTray.exe



    Possible 'Rootkit driver pe386' issue continues to be mentioned in the combofix scan and may still be a critical consideration. Rootkits can be very difficult to completely identify and resolve:

    http://www.google.ca/search?hl=en&q=...G=Search&meta=
  6. 18-09-2006  #15
    zealstarwind
    zealstarwind is offline Newbie
    Save 20% on AVG Internet Security 2012 Suite!
    Well interestingly enough, I took care of that IZX32.exe and the WgaTray.exe and the userinit.exe didnt show up in any other scan, I'll do another Hijackthis and Combofix to make sure its removed, that Combofix was before I removed the Rootkit, so we'll see how clean she truely was hehe

    ME - 06-09-18 11:09:47.81 Service Pack 2
    ComboFix 06.09.14 - Running from: C:\Documents and Settings\ME\Desktop\Desktop Goodies\Windows Cleaning Utilities

    ((((((((((((((((((((((((((((((( Files Created from 2006-08-18 to 2006-09-18 ))))))))))))))))))))))))))))))))))


    2006-09-11 20:06 127,208 --a------ C:\WINDOWS\system32\mucltui.dll


    (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) )))


    2006-09-17 17:15 -------- d-------- C:\Program Files\Iomega
    2006-09-17 15:57 -------- d-------- C:\Program Files\Grisoft
    2006-09-17 07:01 -------- d-------- C:\Program Files\Registry Mechanic
    2006-09-17 06:44 -------- d-------- C:\Program Files\ewido anti-spyware 4.0
    2006-09-17 06:39 -------- d-------- C:\Program Files\Logitech
    2006-09-17 06:17 -------- d-------- C:\Program Files\ATI Technologies
    2006-09-16 14:15 -------- d-------- C:\Documents and Settings\ME\Application Data\ATI
    2006-09-16 02:23 -------- d-------- C:\Program Files\UltimateZip
    2006-09-16 02:20 -------- d--h----- C:\Program Files\InstallShield Installation Information
    2006-09-16 02:10 -------- d-------- C:\Program Files\PartyPoker
    2006-09-15 19:43 -------- d-------- C:\Program Files\iolo
    2006-09-15 17:26 -------- d-a------ C:\Program Files\Common Files
    2006-09-15 03:41 -------- d-------- C:\Program Files\Java
    2006-09-15 03:39 -------- d-------- C:\Program Files\Common Files\Java
    2006-09-15 03:16 -------- d-------- C:\Program Files\CleanUp!
    2006-09-14 02:10 -------- d-------- C:\Program Files\PC Tools AntiVirus
    2006-09-13 22:48 752 --a------ C:\Documents and Settings\ME\Application Data\0d6902ab-3347-418a-a62b-33a1fad5e7a1
    2006-09-13 22:48 1203 --a------ C:\Documents and Settings\ME\Application Data\74cc57f6-dc01-4b99-89f3-fa8590647f90
    2006-09-10 16:55 752 --a------ C:\Documents and Settings\ME\Application Data\c11e60f9-b40d-476b-a3c0-bfded7dc6c63
    2006-09-10 16:55 1203 --a------ C:\Documents and Settings\ME\Application Data\f11b1060-6f4f-4be9-a488-e4927d605f75
    2006-09-09 22:23 -------- d-------- C:\Program Files\Common Files\Microsoft Shared
    2006-09-09 14:50 -------- d-------- C:\Program Files\SoundSpectrum
    2006-09-08 15:33 -------- d---s---- C:\Documents and Settings\ME\Application Data\Microsoft
    2006-09-08 13:51 -------- d-------- C:\Program Files\Common Files\rwqw
    2006-09-02 01:52 -------- d-------- C:\Program Files\THQ
    2006-09-02 01:49 -------- d-------- C:\Program Files\Common Files\Wise Installation Wizard
    2006-09-02 01:48 -------- d-------- C:\Documents and Settings\ME\Application Data\IGN_DLM
    2006-08-29 18:08 -------- d-------- C:\Documents and Settings\ME\Application Data\teamspeak2
    2006-08-24 09:33 98304 --a------ C:\WINDOWS\system32\CmdLineExt.dll
    2006-08-24 09:24 -------- d-------- C:\Program Files\Sierra
    2006-08-21 08:21 16896 --a------ C:\WINDOWS\system32\fltlib.dll
    2006-08-21 08:01 -------- d---s---- C:\Program Files\Xfire
    2006-08-21 05:14 23040 --a------ C:\WINDOWS\system32\fltmc.exe
    2006-08-21 05:14 128896 --------- C:\WINDOWS\system32\drivers\fltmgr.sys
    2006-08-19 16:07 -------- d-------- C:\Documents and Settings\ME\Application Data\Azureus
    2006-08-19 14:27 -------- d-------- C:\Program Files\GameSpy Arcade
    2006-08-15 11:46 -------- d-------- C:\Program Files\Internet Explorer
    2006-07-27 09:24 679424 --a------ C:\WINDOWS\system32\inetcomm.dll
    2006-07-27 04:27 -------- d-------- C:\Program Files\Bit Lord 1.1
    2006-07-26 08:09 6144 --a------ C:\WINDOWS\system32\drivers\anti_rkt.sys
    2006-07-26 08:09 3712 --a------ C:\WINDOWS\system32\drivers\cleandrv.sys
    2006-07-21 04:24 72704 --a------ C:\WINDOWS\system32\hlink.dll
    2006-06-22 01:06 69120 --a------ C:\WINDOWS\system32\ciodm.dll
    2006-06-22 01:06 1435648 --a------ C:\WINDOWS\system32\query.dll


    (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

    *Note* empty entries are not shown

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Runonce]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Runonce\CTStartup]
    "CTStartup"="\"C:\\Program Files\\Creative\\Splash Screen\\CTEaxSpl.EXE\" /play"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
    "CTStartup"="C:\\Program Files\\Creative\\Splash Screen\\CTEaxSpl.EXE /run"
    "Disc Detector"="C:\\Program Files\\Creative\\ShareDLL\\CtNotify.exe"

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components]
    "DeskHtmlVersion"=dword:00000110
    "DeskHtmlMinorVersion"=dword:00000005
    "Settings"=dword:00000001
    "GeneralFlags"=dword:00000001

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\0]
    "Source"=""
    "SubscribedURL"=""
    "FriendlyName"="Desktop Uninstall"
    "Flags"=dword:00000002
    "Position"=hex:2c,00,00,00,00,00,00,00,00,00,00,00 ,00,04,00,00,00,03,00,00,00,\
    00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 ,00,00,00,00,00,00
    "CurrentState"=hex:02,00,00,40
    "OriginalStateInfo"=hex:18,00,00,00,00,00,00,00,00 ,00,00,00,00,00,00,00,00,00,\
    00,00,02,00,00,00
    "RestoredStateInfo"=hex:18,00,00,00,00,00,00,00,00 ,00,00,00,00,00,00,00,00,00,\
    00,00,01,00,00,00

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\shellexecutehooks]
    "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
    "{CEAC6778-3856-45E1-B670-AC837993AFA2}"="{CEAC6778-3856-45E1-B670-AC837993AFA2}"
    "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="ewido anti-spyware 4.0"

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\policies\system]
    "NoDispAppearancePage"=dword:00000000
    "NoColorChoice"=dword:00000000
    "NoSizeChoice"=dword:00000000
    "NoDispBackgroundPage"=dword:00000000
    "NoDispScrSavPage"=dword:00000000
    "NoDispCPL"=dword:00000000
    "NoVisualStyleChoice"=dword:00000000
    "NoDispSettingsPage"=dword:00000000

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\policies\explorer]
    "NoDriveTypeAutoRun"=hex:5f,00,00,00
    @=""
    "NoActiveDesktop"=dword:00000000
    "NoSaveSettings"=dword:00000000
    "ClassicShell"=dword:00000000
    "NoThemesTab"=dword:00000000
    "ForceActiveDesktopOn"=dword:00000000

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\policies\explorer\Run]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\policies\system]
    "dontdisplaylastusername"=dword:00000000
    "legalnoticecaption"=""
    "legalnoticetext"=""
    "shutdownwithoutlogon"=dword:00000001
    "undockwithoutlogon"=dword:00000001
    "DisableTaskMgr"=dword:00000000

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\policies\explorer]
    "NoActiveDesktopChanges"=dword:00000000

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\policies\explorer\Run]

    [HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\Cur rentVersion\policies\explorer]
    "NoDriveTypeAutoRun"=dword:00000091
    "CDRAutoRun"=dword:00000000

    [HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\Cur rentVersion\policies\explorer\Run]

    [HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\polic ies\explorer]
    "NoDriveTypeAutoRun"=dword:00000091
    "CDRAutoRun"=dword:00000000

    [HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\polic ies\explorer\Run]

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\ShellServiceObjectDelayLoad]
    "PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
    "CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
    "WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
    "SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupfolder]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.exe.lnk]
    "backup"="C:\\WINDOWS\\pss\\Adobe Gamma Loader.exe.lnkCommon Startup"
    "location"="Common Startup"
    "command"="C:\\PROGRA~1\\COMMON~1\\Adobe\\CALIBR~1 \\ADOBEG~1.EXE "
    "item"="Adobe Gamma Loader.exe"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^ATI CATALYST System Tray.lnk]
    "backup"="C:\\WINDOWS\\pss\\ATI CATALYST System Tray.lnkCommon Startup"
    "location"="Common Startup"
    "item"="ATI CATALYST System Tray"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^iM StartCenter.lnk]
    "backup"="C:\\WINDOWS\\pss\\iM StartCenter.lnkCommon Startup"
    "location"="Common Startup"
    "item"="iM StartCenter"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech Desktop Messenger.lnk]
    "backup"="C:\\WINDOWS\\pss\\Logitech Desktop Messenger.lnkCommon Startup"
    "location"="Common Startup"
    "item"="Logitech Desktop Messenger"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupfolder\C:^Documents and Settings^ME^Start Menu^Programs^Startup^PowerReg Scheduler V3.exe]
    "backup"="C:\\WINDOWS\\pss\\PowerReg Scheduler V3.exeStartup"
    "location"="Startup"
    "item"="PowerReg Scheduler V3"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupfolder\C:^Documents and Settings^ME^Start Menu^Programs^Startup^TA_Start.lnk]
    "backup"="C:\\WINDOWS\\pss\\TA_Start.lnkStartu p"
    "location"="Startup"
    "item"="TA_Start"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupfolder\C:^Documents and Settings^ME^Start Menu^Programs^Startup^Think-Adz.lnk]
    "backup"="C:\\WINDOWS\\pss\\Think-Adz.lnkStartup"
    "location"="Startup"
    "item"="Think-Adz"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run"
    "item"=""
    "hkey"="HKLM"
    "command"=""
    "inimapping"="0"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\AdaptecDirectCD]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run"
    "item"="DirectCD"
    "hkey"="HKLM"
    "command"="C:\\Program Files\\Adaptec\\Easy CD Creator 5\\DirectCD\\DirectCD.exe"
    "inimapping"="0"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\ADUserMon]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run"
    "item"="ADUserMon"
    "hkey"="HKLM"
    "command"="C:\\Program Files\\Iomega\\AutoDisk\\ADUserMon.exe"
    "inimapping"="0"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\AIM]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run"
    "item"="aim"
    "hkey"="HKCU"
    "command"="C:\\Program Files\\AIM\\aim.exe -cnetwait.odl"
    "inimapping"="0"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\AltnetPointsManager]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run"
    "item"="points manager"
    "hkey"="HKLM"
    "inimapping"="0"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\ASUS Probe]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run"
    "item"="AsusProb"
    "hkey"="HKLM"
    "command"="C:\\Program Files\\ASUS\\Probe\\AsusProb.exe"
    "inimapping"="0"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\ATI DeviceDetect]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run"
    "item"="ATIDtct"
    "hkey"="HKCU"
    "command"="C:\\Program Files\\ATI Multimedia\\main\\ATIDtct.EXE"
    "inimapping"="0"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\ATICCC]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run"
    "item"="cli"
    "hkey"="HKLM"
    "inimapping"="0"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\ATIPTA]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run"
    "item"="atiptaxx"
    "hkey"="HKLM"
    "inimapping"="0"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\CloneCDTray]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run"
    "item"="CloneCDTray"
    "hkey"="HKLM"
    "inimapping"="0"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\CMFibula]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run"
    "item"="CMFibula"
    "hkey"="HKCU"
    "inimapping"="0"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\cprocsvc]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run"
    "item"="cproc"
    "hkey"="HKCU"
    "inimapping"="0"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\CTHelper]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run"
    "item"="CTHELPER"
    "hkey"="HKLM"
    "command"="CTHELPER.EXE"
    "inimapping"="0"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\DaleFord]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run"
    "item"="Gram shim"
    "hkey"="HKLM"
    "inimapping"="0"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\Explorer 2238]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run"
    "item"="dxvwocmq"
    "hkey"="HKLM"
    "inimapping"="0"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\ExploreUpdSched]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run"
    "item"="pwinspex"
    "hkey"="HKLM"
    "inimapping"="0"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\gwiz]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run"
    "item"="ntsystem"
    "hkey"="HKLM"
    "command"="C:\\WINDOWS\\system32\\ntsystem.exe "
    "inimapping"="0"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\HPDJ Taskbar Utility]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run"
    "item"="hpztsb04"
    "hkey"="HKLM"
    "command"="C:\\WINDOWS\\System32\\spool\\drivers\\ w32x86\\3\\hpztsb04.exe"
    "inimapping"="0"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\KernelFaultCheck]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run"
    "item"="dumprep 0 -k"
    "hkey"="HKLM"
    "command"="%systemroot%\\system32\\dumprep 0 -k"
    "inimapping"="0"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\LDM]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run"
    "item"="LogitechDesktopMessenger"
    "hkey"="HKCU"
    "inimapping"="0"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\MSMSGS]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run"
    "item"="msmsgs"
    "hkey"="HKCU"
    "command"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"
    "inimapping"="0"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\NvVideoCenter]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run"
    "item"="NvVid"
    "hkey"="HKLM"
    "inimapping"="0"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\OneCareUI]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run"
    "item"="winssnotify"
    "hkey"="HKLM"
    "inimapping"="0"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\P2P Networking]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run"
    "item"="P2P Networking"
    "hkey"="HKLM"
    "inimapping"="0"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\PCTAVApp]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run"
    "item"="PCTAV"
    "hkey"="HKCU"
    "command"="\"C:\\Program Files\\PC Tools AntiVirus\\PCTAV.exe\" /MONITORSCAN"
    "inimapping"="0"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\pop06apelt]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run"
    "item"="thiselt"
    "hkey"="HKLM"
    "inimapping"="0"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\PSCloner]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run"
    "item"="PSCloner"
    "hkey"="HKCU"
    "inimapping"="0"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\QuickTime Task]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run"
    "item"="qttask"
    "hkey"="HKLM"
    "command"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
    "inimapping"="0"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\RegistryMechanic]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run"
    "item"=""
    "hkey"="HKLM"
    "command"=""
    "inimapping"="0"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\septpop06apsept]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run"
    "item"="septpop06apsept"
    "hkey"="HKLM"
    "inimapping"="0"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\STYLEXP]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run"
    "item"="StyleXP"
    "hkey"="HKCU"
    "command"="C:\\Program Files\\TGTSoft\\StyleXP\\StyleXP.exe -Hide"
    "inimapping"="0"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\SunJavaUpdateSched]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run"
    "item"="jusched"
    "hkey"="HKLM"
    "inimapping"="0"
    "command"="C:\\Program Files\\Java\\jre1.5.0_06\\bin\\jusched.exe"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\Taskbar]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run"
    "item"="CTLTask"
    "hkey"="HKCU"
    "command"="C:\\Program Files\\Creative\\SBAudigy\\Taskbar\\CTLTask.exe"
    "inimapping"="0"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\TaskTray]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run"
    "item"="CTLTray"
    "hkey"="HKCU"
    "command"="C:\\Program Files\\Creative\\SBAudigy\\Taskbar\\CTLTray.exe"
    "inimapping"="0"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\TheMonitor]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run"
    "item"="Duce6"
    "hkey"="HKLM"
    "inimapping"="0"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\type32]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run"
    "item"="type32"
    "hkey"="HKLM"
    "command"="\"C:\\Program Files\\Microsoft IntelliType Pro\\type32.exe\""
    "inimapping"="0"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\ucwpbtwA]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run"
    "item"="ucwpbtwA"
    "hkey"="HKLM"
    "inimapping"="0"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\UpdReg]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run"
    "item"="Updreg"
    "hkey"="HKLM"
    "command"="C:\\WINDOWS\\Updreg.exe"
    "inimapping"="0"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\ViewMgr]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run"
    "item"="ViewMgr"
    "hkey"="HKLM"
    "command"="C:\\Program Files\\Viewpoint\\Viewpoint Manager\\ViewMgr.exe"
    "inimapping"="0"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\WheelMouse]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run"
    "item"="Amoumain"
    "hkey"="HKLM"
    "command"="C:\\PROGRA~1\\Hardware\\Mouse\\Amoumain .exe"
    "inimapping"="0"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\win3206141217122]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run"
    "item"="win3206141217122"
    "hkey"="HKLM"
    "inimapping"="0"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\WinAuth]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run"
    "item"="winlogon"
    "hkey"="HKLM"
    "inimapping"="0"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\Yahoo! Pager]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run"
    "item"="YahooMessenger"
    "hkey"="HKCU"
    "inimapping"="0"
    "command"="\"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe\" -quiet"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\zBrowser Launcher]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run"
    "item"="iTouch"
    "hkey"="HKLM"
    "command"="C:\\Program Files\\Logitech\\iTouch\\iTouch.exe"
    "inimapping"="0"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\zej32c5f]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run"
    "item"="RUNDLL32"
    "hkey"="HKLM"
    "command"="RUNDLL32.EXE w006bb9c.dll,n 00432c5b00000005006bb9c"
    "inimapping"="0"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\{10-05-55-5D-ZN}]
    "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersio n\\Run"
    "item"="ordsregr"
    "hkey"="HKLM"
    "inimapping"="0"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\services]
    "_IOMEGA_ACTIVE_DISK_SERVICE_"=dword:00000002
    "StyleXPService"=dword:00000002
    "PCTAVSvc"=dword:00000002
    "MSMPSVC"=dword:00000002
    "msfwsvc"=dword:00000002
    "Iomega App Services"=dword:00000002
    "Creative Service for CDROM Access"=dword:00000002
    "ATI Smart"=dword:00000002
    "Ati HotKey Poller"=dword:00000002
    "winss"=dword:00000002
    "ewido anti-spyware 4.0 guard"=dword:00000002
    "ETXV"=dword:00000003


    HKEY_LOCAL_MACHINE\system\currentcontrolset\contro l\securityproviders
    securityproviders REG_SZ msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, zwebauth.dll, ntoskrnl.dll


    Completion time: Mon 09/18/2006 11:10:46.81
    ComboFix.txt
    ComboFix2.txt
    ComboFix3.txt
    and
    Logfile of HijackThis v1.99.1
    Scan saved at 11:12:59 AM, on 9/18/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\SYSTEM32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\MsPMSPSv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Creative\ShareDLL\CtNotify.exe
    C:\Program Files\Creative\ShareDLL\MediaDet.Exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\HJTL1991\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/...ch/search.html
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/.../www.yahoo.com
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = localhost
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
    O2 - BHO: YahooTaggedBM Class - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - C:\Program Files\Yahoo!\Common\YIeTagBm.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
    O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
    O4 - HKLM\..\Run: [CTStartup] C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE /run
    O4 - HKLM\..\Run: [Disc Detector] C:\Program Files\Creative\ShareDLL\CtNotify.exe
    O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
    O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
    O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
    O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
    O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra button: Microsoft® JavaScript® Console - {1A93798A-BEEA-4442-A37F-0F4A97F39E7D} - C:\WINDOWS\system32\comdlg32.ocx
    O9 - Extra 'Tools' menuitem: JavaScript Console - {1A93798A-BEEA-4442-A37F-0F4A97F39E7D} - C:\WINDOWS\system32\comdlg32.ocx
    O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
    O9 - Extra button: Microsoft® JavaScript® Console - {6F8B49F7-8FEB-4465-B6CB-32FAB1B20235} - C:\WINDOWS\system32\comdlg32.ocx
    O9 - Extra 'Tools' menuitem: JavaScript Console - {6F8B49F7-8FEB-4465-B6CB-32FAB1B20235} - C:\WINDOWS\system32\comdlg32.ocx
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
    O9 - Extra button: Microsoft® JavaScript® Console - {F08A6623-B993-4F7F-8076-56B7C37DE706} - C:\WINDOWS\system32\comdlg32.ocx
    O9 - Extra 'Tools' menuitem: JavaScript Console - {F08A6623-B993-4F7F-8076-56B7C37DE706} - C:\WINDOWS\system32\comdlg32.ocx
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra button: Microsoft® JavaScript® Console - {1A93798A-BEEA-4442-A37F-0F4A97F39E7D} - C:\WINDOWS\system32\comdlg32.ocx (HKCU)
    O9 - Extra button: Microsoft® JavaScript® Console - {F08A6623-B993-4F7F-8076-56B7C37DE706} - C:\WINDOWS\system32\comdlg32.ocx (HKCU)
    O9 - Extra 'Tools' menuitem: JavaScript Console - {F08A6623-B993-4F7F-8076-56B7C37DE706} - C:\WINDOWS\system32\comdlg32.ocx (HKCU)
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15015/CTSUEng.cab
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkID=39204
    O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - http://gamingzone.ubisoft.com/dev/pa.../GSManager.cab
    O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/ca...C_2.2.1.87.cab
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1158011731186
    O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://launch.gamespyarcade.com/soft...ch/alaunch.cab
    O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/7...ll/xscan53.cab
    O16 - DPF: {82202BE7-C56A-487E-9E55-D84BDC1A5776} (AnarkClient Class) - http://install.anark.com/client/vers...n/AMClient.cab
    O16 - DPF: {8E28B3A9-FE83-45D1-B657-D5426B81A121} (CustomerCtrl Class) - http://cs2b.instantservice.com/jars/...rxsigned40.cab
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
    O16 - DPF: {B3872502-F9FD-4E96-93FF-0D37298F0689} (SOESysInfo Control) - http://swgbetareg.station.sony.com/soesysinfo.cab
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10...o.cab34246.cab
    O16 - DPF: {E504EE6E-47C6-11D5-B8AB-00D0B78F3D48} (Yahoo! Webcam Viewer Wrapper) - http://chat.yahoo.com/cab/yvwrctl.cab
    O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
    O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
    O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15016/CTPID.cab
    O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/_media/dalaillama/ampx.cab
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    Last edited by zealstarwind; 18-09-2006 at 04:14 PM.
+ Reply to Thread
Page 2 of 2 FirstFirst 1 2
« Out of Disk Space??? | Laptop problem: need help »