Win32:PurityScan-AF virus??  I need help once again

system · 2007-07-02T03:16:51.000Z

< HOSTS File > (686 bytes) → C:\WINDOWS\System32\drivers\etc\Hosts →
127.0.0.1 localhost → →
< Internet Explorer Settings > → →
HKLM: Default_Page_URL → http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q305&bd=pavilion&pf=laptop →
HKLM: Main\Default_Search_URL → http://www.google.com/ie →
HKLM: Local Page → %SystemRoot%\system32\blank.htm →
HKLM: Search Bar → http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html →
HKLM: Search Page → http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://www.yahoo.com →
HKLM: Start Page → about:blank →
HKLM: CustomizeSearch → http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm →
HKLM: Search\Default_Search_URL → http://www.google.com/ie →
HKLM: SearchAssistant → http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm →
HKCU: Local Page → C:\WINDOWS\system32\blank.htm →
HKCU: Search Page → http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch →
HKCU: Start Page → http://yahoo.com/ →
HKCU: ProxyEnable → 0 →
< Trusted Sites > → HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ →
msn.com [ - ] → →
< Trusted Sites > → HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ →
www_yahoo.com [https] → →
< BHO’s > → HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ →
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} [HKLM] → %ProgramFiles%\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll [AcroIEHlprObj Class] → Adobe Systems Incorporated [Ver = 6.0.1.2003110300 | Size = 54248 bytes | Modified Date = 2003-11-03 PM 4:17:44 | Attr = ]
{1F6581D5-AA53-4b73-A6F9-41420C6B61F1} [HKLM] → %System32%\mtgafqjo.dll [Reg Data - Value does not exist] → File not found
{53707962-6F74-2D53-2644-206D7942484F} [HKLM] → %ProgramFiles%\Spybot - Search & Destroy\SDHelper.dll → Safer Networking Limited [Ver = 1, 4, 0, 0 | Size = 853672 bytes | Modified Date = 2005-05-31 AM 1:04:00 | Attr = ]
{5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} [HKLM] → %ProgramFiles%\Yahoo!\Common\yiesrvc.dll [Yahoo! IE Services Button] → Yahoo! Inc. [Ver = 2006, 10, 31, 3 | Size = 198136 bytes | Modified Date = 2006-10-31 PM 3:33:52 | Attr = ]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} [HKLM] → %ProgramFiles%\Java\jre1.6.0_01\bin\ssv.dll [SSVHelper Class] → Sun Microsystems, Inc. [Ver = 6.0.10.6 | Size = 501400 bytes | Modified Date = 2007-03-14 AM 3:43:40 | Attr = ]
{81DD6C8F-EA28-4CFF-A56A-5BD9A8F1D1FD} [HKLM] → Reg Data - Key not found [Reg Data - Key not found] → File not found
{AA58ED58-01DD-4d91-8333-CF10577473F7} [HKLM] → %ProgramFiles%\Google\googletoolbar2.dll [Google Toolbar Helper] → Google Inc. [Ver = 4, 0, 1601, 4978 | Size = 2403392 bytes | Modified Date = 2007-01-19 PM 11:55:32 | Attr = R ]
< Internet Explorer ToolBars [HKLM] > → HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar →
[HKLM] → Reg Data - Key not found [Reg Data - Value does not exist] → File not found
{2318C2B1-4965-11d4-9B18-009027A5CD4F} [HKLM] → %ProgramFiles%\Google\googletoolbar2.dll [&Google] → Google Inc. [Ver = 4, 0, 1601, 4978 | Size = 2403392 bytes | Modified Date = 2007-01-19 PM 11:55:32 | Attr = R ]
{B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} [HKLM] → %ProgramFiles%\Hp\Digital Imaging\bin\HPDTLK02.dll [HP view] → Hewlett-Packard Company [Ver = 1.0.0.7 | Size = 98304 bytes | Modified Date = 2003-11-21 AM 5:26:28 | Attr = ]
< Internet Explorer ToolBars [HKCU] > → HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ →
ShellBrowser\{B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} [HKLM] → %ProgramFiles%\Hp\Digital Imaging\bin\HPDTLK02.dll [HP view] → Hewlett-Packard Company [Ver = 1.0.0.7 | Size = 98304 bytes | Modified Date = 2003-11-21 AM 5:26:28 | Attr = ]
WebBrowser\{2318C2B1-4965-11D4-9B18-009027A5CD4F} [HKLM] → %ProgramFiles%\Google\googletoolbar2.dll [&Google] → Google Inc. [Ver = 4, 0, 1601, 4978 | Size = 2403392 bytes | Modified Date = 2007-01-19 PM 11:55:32 | Attr = R ]
WebBrowser\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} [HKLM] → Reg Data - Key not found [Reg Data - Key not found] → File not found
WebBrowser\{4982D40A-C53B-4615-B15B-B5B5E98D167C} [HKLM] → Reg Data - Key not found [Reg Data - Key not found] → File not found
WebBrowser\{B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} [HKLM] → %ProgramFiles%\Hp\Digital Imaging\bin\HPDTLK02.dll [HP view] → Hewlett-Packard Company [Ver = 1.0.0.7 | Size = 98304 bytes | Modified Date = 2003-11-21 AM 5:26:28 | Attr = ]
< Internet Explorer Extensions [HKLM] > → HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\ →
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} [HKLM] → %ProgramFiles%\Java\jre1.6.0_01\bin\npjpi160_01.dll [MenuText: Sun Java Console] → Sun Microsystems, Inc. [Ver = 6.0.10.6 | Size = 132760 bytes | Modified Date = 2007-03-14 AM 3:43:42 | Attr = ]
{5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} → Reg Data - Value does not exist [ButtonText: Yahoo! Services] → File not found
{CD67F990-D8E9-11d2-98FE-00C0F0318AFE} → Reg Data - Value does not exist [ButtonText: Real.com] → File not found
< Internet Explorer Menu Extensions [HKCU] > → HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\ →
&AOL Toolbar search → %ProgramFiles%\AOL Toolbar\toolbar.dll\SEARCH.HTM → File not found
&Google Search → %ProgramFiles%\Google\GoogleToolbar1.dll\cmsearch.htm → File not found
Backward Links → %ProgramFiles%\Google\GoogleToolbar1.dll\cmbacklinks.htm → File not found
Cached Snapshot of Page → %ProgramFiles%\Google\GoogleToolbar1.dll\cmcache.htm → File not found
E&xport to Microsoft Excel → → File not found
Similar Pages → %ProgramFiles%\Google\GoogleToolbar1.dll\cmsimilar.htm → File not found
Translate into English → %ProgramFiles%\Google\GoogleToolbar1.dll\cmtrans.htm → File not found
< User Agent Post Platform [HKLM] > → HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform →
SV1 → →
< DNS Name Servers [HKLM] > → HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Adapters\ →
{5F47C24C-E1E4-4206-A770-13751059C1B6} → (Airlink101 Super G Cardbus Adapter) →
{88D6CB69-2796-421A-947C-8ABE5BCF3389} → (Realtek RTL8139/810x Family Fast Ethernet NIC) →
{DB92313F-449F-4995-9964-1BA2360A9476} → (Broadcom 802.11b/g WLAN) →
{E8B6B49F-5814-4947-A101-7512A4B92FC7} → (Westell WireSpeed Dual Connect Modem) →
< Protocol Handlers [HKLM] > → HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\ →
ipp → Reg Data - Key not found → File not found
msdaipp → Reg Data - Key not found → File not found
< Downloaded Program Files > → HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\ →
{166B1BCA-3F9C-11CF-8075-444553540000} → Shockwave ActiveX Control - CodeBase = http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab →
{17492023-C23A-453E-A040-C7C580BBF700} → Windows Genuine Advantage Validation Tool - CodeBase = http://go.microsoft.com/fwlink/?linkid=39204 →
{30528230-99f7-4bb4-88d8-fa1d4f56a2ab} → Installation Support - CodeBase = C:\Program Files\Yahoo!\Common\Yinsthelper.dll →
{406B5949-7190-4245-91A9-30A17DE16AD0} → Snapfish Activia - CodeBase = http://photos.walmart.com/WalmartActivia.cab →
{6414512B-B978-451D-A0D8-FCFDF33E833C} → WUWebControl Class - CodeBase = http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1176249475250 →
{6E32070A-766D-4EE6-879C-DC1FA91D2FC3} → MUWebControl Class - CodeBase = http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1176249440859 →
{8AD9C840-044E-11D1-B3E9-00805F499D93} → Java Plug-in 1.6.0_01 - CodeBase = http://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab →
{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} → Java Plug-in 1.6.0_01 - CodeBase = http://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab →
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} → Java Plug-in 1.6.0_01 - CodeBase = http://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab →

system · 2007-07-02T03:17:26.000Z

[Files/Folders - Created Within 30 days]
boot.ini.comodofirewall → %SystemDrive%\boot.ini.comodofirewall → [Ver = | Size = 211 bytes | Created Date = 2007-06-27 PM 11:06:05 | Attr = ]
hiberfil.sys → %SystemDrive%\hiberfil.sys → [Ver = | Size = 233361408 bytes | Created Date = 1601-01-01 AM 6:00:00 | Attr = HS]
IO.SYS → %SystemDrive%\IO.SYS → [Ver = | Size = 0 bytes | Created Date = 2007-06-16 PM 11:14:36 | Attr = RHS]
MSDOS.SYS → %SystemDrive%\MSDOS.SYS → [Ver = | Size = 0 bytes | Created Date = 2007-06-16 PM 11:14:36 | Attr = RHS]
QooBox → %SystemDrive%\QooBox → [Folder | Created Date = 2007-06-25 PM 10:40:02 | Attr = ]
VundoFix Backups → %SystemDrive%\VundoFix Backups → [Folder | Created Date = 2007-06-27 PM 9:28:54 | Attr = ]
_OTMoveIt → %SystemDrive%_OTMoveIt → [Folder | Created Date = 2007-06-26 PM 10:40:00 | Attr = ]
$NtUninstallKB929123$ → %SystemRoot%$NtUninstallKB929123$ → [Folder | Created Date = 2007-06-13 AM 2:04:45 | Attr = H ]
$NtUninstallKB933566$ → %SystemRoot%$NtUninstallKB933566$ → [Folder | Created Date = 2007-06-13 AM 2:05:49 | Attr = H ]
$NtUninstallKB935839$ → %SystemRoot%$NtUninstallKB935839$ → [Folder | Created Date = 2007-06-13 AM 2:01:59 | Attr = H ]
$NtUninstallKB935840$ → %SystemRoot%$NtUninstallKB935840$ → [Folder | Created Date = 2007-06-13 AM 2:04:30 | Attr = H ]
catchme.exe → %SystemRoot%\catchme.exe → [Ver = | Size = 87552 bytes | Created Date = 2007-06-25 PM 10:25:19 | Attr = ]
ERDNT → %SystemRoot%\ERDNT → [Folder | Created Date = 2007-06-28 PM 9:52:41 | Attr = ]
nircmd.exe → %SystemRoot%\nircmd.exe → NirSoft [Ver = 1.85 | Size = 49152 bytes | Created Date = 2007-06-25 PM 10:25:18 | Attr = ]
QTFont.for → %SystemRoot%\QTFont.for → [Ver = | Size = 1409 bytes | Created Date = 2007-06-16 PM 12:03:32 | Attr = ]
QTFont.qfn → %SystemRoot%\QTFont.qfn → [Ver = | Size = 54156 bytes | Created Date = 2007-06-16 PM 12:03:32 | Attr = H ]
java.exe → %System32%\java.exe → Sun Microsystems, Inc. [Ver = 6.0.10.6 | Size = 135168 bytes | Created Date = 2007-06-20 AM 11:51:15 | Attr = ]
javacpl.cpl → %System32%\javacpl.cpl → Sun Microsystems, Inc. [Ver = 6.0.10.6 | Size = 69632 bytes | Created Date = 2007-06-20 AM 11:51:16 | Attr = ]
javaw.exe → %System32%\javaw.exe → Sun Microsystems, Inc. [Ver = 6.0.10.6 | Size = 135168 bytes | Created Date = 2007-06-20 AM 11:51:15 | Attr = ]
javaws.exe → %System32%\javaws.exe → Sun Microsystems, Inc. [Ver = 6.0.10.6 | Size = 139264 bytes | Created Date = 2007-06-20 AM 11:51:16 | Attr = ]
swreg.exe → %System32%\swreg.exe → SteelWerX [Ver = 2.0.1.6 | Size = 428032 bytes | Created Date = 2007-06-25 PM 10:25:19 | Attr = ]
swsc.exe → %System32%\swsc.exe → SteelWerX [Ver = 2.0.0.0 | Size = 370688 bytes | Created Date = 2007-06-25 PM 10:25:18 | Attr = ]
swxcacls.exe → %System32%\swxcacls.exe → SteelWerX [Ver = 1.0.1.1 | Size = 212480 bytes | Created Date = 2007-06-25 PM 10:25:18 | Attr = ]
vfind.exe → %System32%\vfind.exe → [Ver = | Size = 49152 bytes | Created Date = 2007-06-19 PM 6:58:34 | Attr = ]
AvgAsCln.sys → %System32%\drivers\AvgAsCln.sys → GRISOFT, s.r.o. [Ver = 1.0.0.14 | Size = 10872 bytes | Created Date = 2007-06-20 PM 11:37:35 | Attr = ]
cmdmon.sys → %System32%\drivers\cmdmon.sys → Comodo Research Lab., Inc. [Ver = 2.3.035 built by: WinDDK | Size = 75520 bytes | Created Date = 2007-06-27 PM 11:03:52 | Attr = ]
inspect.sys → %System32%\drivers\inspect.sys → COMODO [Ver = 2, 0, 0, 1 | Size = 51328 bytes | Created Date = 2007-06-27 PM 11:03:52 | Attr = ]

[Files/Folders - Modified Within 30 days]
boot.ini → %SystemDrive%\boot.ini → [Ver = | Size = 211 bytes | Modified Date = 2007-06-28 AM 12:06:06 | Attr = RHS]
Config.Msi → %SystemDrive%\Config.Msi → [Folder | Modified Date = 2007-06-20 PM 5:07:22 | Attr = H ]
hiberfil.sys → %SystemDrive%\hiberfil.sys → [Ver = | Size = 233361408 bytes | Modified Date = 2007-07-01 PM 7:07:06 | Attr = HS]
IO.SYS → %SystemDrive%\IO.SYS → [Ver = | Size = 0 bytes | Modified Date = 2007-06-17 AM 12:14:38 | Attr = RHS]
MSDOS.SYS → %SystemDrive%\MSDOS.SYS → [Ver = | Size = 0 bytes | Modified Date = 2007-06-17 AM 12:14:38 | Attr = RHS]
Program Files → %ProgramFiles% → [Folder | Modified Date = 2007-06-30 PM 1:35:40 | Attr = R ]
QooBox → %SystemDrive%\QooBox → [Folder | Modified Date = 2007-06-25 PM 11:40:04 | Attr = ]
VundoFix Backups → %SystemDrive%\VundoFix Backups → [Folder | Modified Date = 2007-07-01 PM 7:01:38 | Attr = ]
WINDOWS → %SystemRoot% → [Folder | Modified Date = 2007-07-01 PM 10:08:12 | Attr = ]
_OTMoveIt → %SystemDrive%_OTMoveIt → [Folder | Modified Date = 2007-06-26 PM 11:40:02 | Attr = ]
$hf_mig$ → %SystemRoot%$hf_mig$ → [Folder | Modified Date = 2007-06-13 AM 2:18:10 | Attr = H ]
$NtUninstallKB929123$ → %SystemRoot%$NtUninstallKB929123$ → [Folder | Modified Date = 2007-06-13 AM 3:04:50 | Attr = H ]
$NtUninstallKB933566$ → %SystemRoot%$NtUninstallKB933566$ → [Folder | Modified Date = 2007-06-13 AM 3:05:56 | Attr = H ]
$NtUninstallKB935839$ → %SystemRoot%$NtUninstallKB935839$ → [Folder | Modified Date = 2007-06-13 AM 3:02:02 | Attr = H ]
$NtUninstallKB935840$ → %SystemRoot%$NtUninstallKB935840$ → [Folder | Modified Date = 2007-06-13 AM 3:04:34 | Attr = H ]
bootstat.dat → %SystemRoot%\bootstat.dat → [Ver = | Size = 2048 bytes | Modified Date = 2007-07-01 PM 7:07:16 | Attr = S]
catchme.exe → %SystemRoot%\catchme.exe → [Ver = | Size = 87552 bytes | Modified Date = 2007-06-05 AM 5:24:04 | Attr = ]
Downloaded Program Files → %SystemRoot%\Downloaded Program Files → [Folder | Modified Date = 2007-06-26 PM 11:32:30 | Attr = S]
ERDNT → %SystemRoot%\ERDNT → [Folder | Modified Date = 2007-06-29 PM 1:52:36 | Attr = ]
Help → %SystemRoot%\Help → [Folder | Modified Date = 2007-06-20 PM 3:30:20 | Attr = ]
inf → %SystemRoot%\inf → [Folder | Modified Date = 2007-06-22 AM 7:55:58 | Attr = H ]
Installer → %SystemRoot%\Installer → [Folder | Modified Date = 2007-06-20 PM 5:07:22 | Attr = HS]
Prefetch → %SystemRoot%\Prefetch → [Folder | Modified Date = 2007-07-01 PM 8:07:04 | Attr = ]
QTFont.for → %SystemRoot%\QTFont.for → [Ver = | Size = 1409 bytes | Modified Date = 2007-06-16 PM 1:03:34 | Attr = ]
QTFont.qfn → %SystemRoot%\QTFont.qfn → [Ver = | Size = 54156 bytes | Modified Date = 2007-06-16 PM 1:03:34 | Attr = H ]
Registration → %SystemRoot%\Registration → [Folder | Modified Date = 2007-06-25 PM 7:19:24 | Attr = ]
system32 → %System32% → [Folder | Modified Date = 2007-07-01 PM 10:08:12 | Attr = ]
Tasks → %SystemRoot%\Tasks → [Folder | Modified Date = 2007-07-01 PM 7:10:38 | Attr = S]
Temp → %SystemRoot%\Temp → [Folder | Modified Date = 2007-07-01 PM 7:27:36 | Attr = ]
MP Scheduled Scan.job → %SystemRoot%\tasks\MP Scheduled Scan.job → [Ver = | Size = 330 bytes | Modified Date = 2007-07-01 PM 7:10:38 | Attr = H ]
SA.DAT → %SystemRoot%\tasks\SA.DAT → [Ver = | Size = 6 bytes | Modified Date = 2007-07-01 PM 7:07:26 | Attr = H ]
CatRoot2 → %System32%\CatRoot2 → [Folder | Modified Date = 2007-07-01 PM 4:06:22 | Attr = ]
dllcache → %System32%\dllcache → [Folder | Modified Date = 2007-06-21 AM 2:16:42 | Attr = RHS]
drivers → %System32%\drivers → [Folder | Modified Date = 2007-07-01 PM 4:11:28 | Attr = ]
Macromed → %System32%\Macromed → [Folder | Modified Date = 2007-06-22 AM 7:53:34 | Attr = ]
wpa.dbl → %System32%\wpa.dbl → [Ver = | Size = 1158 bytes | Modified Date = 2007-07-01 PM 7:10:26 | Attr = ]
cmdmon.sys → %System32%\drivers\cmdmon.sys → Comodo Research Lab., Inc. [Ver = 2.3.035 built by: WinDDK | Size = 75520 bytes | Modified Date = 2007-06-28 AM 12:03:50 | Attr = ]
etc → %System32%\drivers\etc → [Folder | Modified Date = 2007-06-30 PM 8:11:56 | Attr = ]
inspect.sys → %System32%\drivers\inspect.sys → COMODO [Ver = 2, 0, 0, 1 | Size = 51328 bytes | Modified Date = 2007-06-28 AM 12:03:50 | Attr = ]

< End of report >

system · 2007-07-02T03:18:45.000Z

I didn’t encounter any problems when I ran the scan.

system · 2007-07-02T12:02:36.000Z

Your winpfind log looks good now, but please post a fresh HJT log - I think we might have a line or two to clean up there.

What is the status of the trojan alerts now?

system · 2007-07-02T21:02:06.000Z

Logfile of HijackThis v1.99.1
Scan saved at 4:00, on 2007-07-02
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Comodo\Firewall\cmdagent.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Airlink101\AWLC4030\WLService.exe
C:\Program Files\Airlink101\AWLC4030\WLanCfgAG.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\Program Files\HPQ\SHARED\HPQWMI.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Comodo\Firewall\CPF.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Hp\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Adobe\Acrobat 6.0\Reader\AcroRd32.exe
C:\Program Files\Hijackthis\HijackThis.exe

system · 2007-07-02T21:02:58.000Z

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q305&bd=pavilion&pf=laptop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1F6581D5-AA53-4b73-A6F9-41420C6B61F1} - C:\WINDOWS\system32\mtgafqjo.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {81DD6C8F-EA28-4CFF-A56A-5BD9A8F1D1FD} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: HP view - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM..\Run: [Windows Defender] “C:\Program Files\Windows Defender\MSASCui.exe” -hide
O4 - HKLM..\Run: [QuickTime Task] “C:\Program Files\QuickTime\qttask.exe” -atboottime
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
O4 - HKLM..\Run: [!AVG Anti-Spyware] “C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe” /minimized
O4 - HKLM..\Run: [COMODO Firewall Pro] “C:\Program Files\Comodo\Firewall\CPF.exe” /background
O4 - HKCU..\Run: [MSMSGS] “C:\Program Files\Messenger\msmsgs.exe” /background
O4 - HKCU..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU..\Run: [Yahoo! Pager] “C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe” -quiet
O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
O4 - Startup: wkcalrem.LNK = C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hp\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\npjpi160_01.dll
O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\npjpi160_01.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q305&bd=pavilion&pf=laptop
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photos.walmart.com/WalmartActivia.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1176249475250
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1176249440859
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Program Files\Comodo\Firewall\cmdagent.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Super G Wireless Cardbus Service - Unknown owner - C:\Program Files\Airlink101\AWLC4030\WLService.exe

system · 2007-07-02T23:17:56.000Z

Open HJT again and click Do a System Scan Only. Place a check next to these lines and, after closing all other windows (including your browser) click Fix Checked

[b]O2 - BHO: (no name) - {1F6581D5-AA53-4b73-A6F9-41420C6B61F1} - C:\WINDOWS\system32\mtgafqjo.dll (file missing)

O2 - BHO: (no name) - {81DD6C8F-EA28-4CFF-A56A-5BD9A8F1D1FD} - (no file)[/b]

I need a little information from you now. How is the computer running? Have the trojan alerts ended?

system · 2007-07-03T00:51:14.000Z

I’ve done the fixed checked, what should I do now?

The computer is running a lot better, I haven’t had a trojan alert in the past few days. The only problem I am having is the screen going green on me and the lines cutting across and filling the page. I hadn’t had the problem til these recent trojans so I didn’t know if there’s a correlation. Everything else seems to be running fine. I did notice that my screen saver does not go on anymore like it used and I haven’t made any changes.

system · 2007-07-03T01:04:39.000Z

I’m still a bit concerned about this file

C:\Program Files\Messenger\meqot43855.dll

See if you can rename it from meqot43855.dll to meqot43855.old

Then upload the renamed file to Virus Total. If this works post the results of the scan.

With the green lines the only thing I can think of, other than a hardware problem, is if the video driver became corrupted. If you tell me the make and exact model of your computer (and video card if you have one) I’ll see if I can find a driver to download. I will tell you, too, that I downloaded a driver update on my laptop a couple days ago that completely messed things. Have there been any video updates recently on yours?

If you right click your screen and click Properties can you reset your screen saver from there?

system · 2007-07-03T01:33:06.000Z

I’m having finding the file.
I have done a search for it but it says file cannot be found. I did find the folder Messenger but it did not have meqot43855.

Lisandro · 2007-07-03T01:53:55.000Z

brenda31 post:114:

The only problem I am having is the screen going green on me and the lines cutting across and filling the page.

Can you post a screenshot?
To know how to post a screenshot, see http://forum.avast.com/index.php?topic=8982.0
You can use Gadwin PrintScreen to get a screenshot (http://www.gadwin.com/printscreen/) or the free version of WinSnap 1.1.10 (http://www.filehippo.com/download_winsnap/?2173).

system · 2007-07-03T02:03:15.000Z

In addition to the screen shot, click Start>My Computer>Tools (at the top of the window that opened)>Folder Options>View Tab.

Make sure Show Hidden Files and Folders is checked and Hide Protected Operating System Files is not checked.

Now double click C:> double click Program Files> double click Messenger.

Is the file present now?

system · 2007-07-03T02:09:16.000Z

It is not there. I only have msglangs.dll, msgsc.dll, custstat.dll

system · 2007-07-03T02:30:57.000Z

OK 8)

Uninstall 7 Zip to get those extraneous files off your desktop.

If you want to reinstall this program again (it is handy) make sure to use the default installation path.

Next, open OTMoveIt and click the CleanUp! button You may get prompted by your firewall that OTMoveIt wants to contact the internet, allow this, a cleanup.txt will be downloaded, and a message dialog will ask you if you want to proceed with the cleanup process. Click Yes. This will delete all the tools you have downloaded plus itself

Now the step that you may have overlooked in your earlier thread but is important:

Click Start>All Programs>Accessories > System tools > System Restore
In the dialog box that appears Click in the radio button to Create a Restore Point
Click NEXT
Enter a name you will remember if you need to find this again (like Clean Point)
Click CREATE

You now have a clean restore point, to get rid of the old ones:

Click Start>All Programs>Accessories > System tools > Disk Clean Up
Click OK on the C: drive
Click the More Options tab
In the System Restore section click the Clean Up button

Now download ATF Cleaner by Atribune to your desktop, Double click ATF-Cleaner.exe to run the program. Put a check mark in all the options except Prefetch and click Empty Selected. If you use Firefox or Opera click those tabs and clean those too (you might want to leave Saved Passwords unchecked).

Then the screen shot of the video problems Tech asked for would be helpful.

EDIT:

brenda31 post:114:

I did notice that my screen saver does not go on anymore like it used and I haven’t made any changes.

If you downloaded a free screen saver from an internet site it may have been deleted during our cleaning process. Those sites are often the source of adware and trojans and are best avoided.

Lisandro · 2007-07-03T02:39:14.000Z

And the screenshot?

system · 2007-07-03T03:01:22.000Z

Sorry, I totally missed the part about the screenshot. Let me see if I can do that.

system · 2007-07-03T03:13:15.000Z

Here is the snapshot.

Lisandro · 2007-07-03T03:19:56.000Z

brenda31 post:114:

The only problem I am having is the screen going green on me and the lines cutting across and filling the page.

Where are the lines? ???

system · 2007-07-03T03:35:30.000Z

Well the lines come and go and go and they’ll fill up the whole screen. When this happens then I can’t move my mouse. It seems like it’ll get frozen for a second with a line cutting horizontally across the screen and if I move the screen, then it’ll unfreeze and the horizontal line will move either up or down. Then the whole screen goes green/pink with lines going from top to bottom. It hasn’t happened in a little while. If I’m able to I will post a pic if it happens again.

system · 2007-07-03T03:50:40.000Z

Does it look like these

http://discussions.virtualdr.com/showthread.php?t=176454

Its amazing how many hits you get if you google “green and pink screen lines”.

Announcements