thenelson
asked on
wareout infection on Vista
I have a wareout infection on Vista. Fixwareout.exe will not run on Vista. HijackThis and Malwarebytes' Anti-Malware will not run.
Help!
Help!
ASKER
Thanks for the suggestion. I downloaded Kaspersky Internet Security 2009 trial version, uninstalled AVG Antivirus security and tried to install Kaspersky but it thinks AVG is still installed and will not install.
I found the overly complicated workaround on their FAQ (pasted below) but ran into these problems with it:
download from the link http://www.kaspersky.com/productupdates - Could not download it timed out.
In order to start Kaspersky Anti-Virus 2009\Kaspersky Internet Security 2009 and skip scan for incompatible software, do the following:
* download the distributive of the latest version of Kaspersky Anti-Virus 2009\ Kaspersky Internet Security 2009 from the link http://www.kaspersky.com/productupdates and save it on your PC.
* run the product installation
* in the Setup Wizard window click Cancel
make sure the following folder appeared on the local disc: \ProgramData\Kaspersky Lab Setup Files\Kaspersky Internet Security 2009\English with the embedded files setup.exe and kis.en.msi - not there
enter [full path to setup.exe file] /pSKIPPRODUCTCHECK=1 - failed
any ideas?
* make sure the following folder appeared on the local disc:
o for Windows XP on the local disk C:\:
+ if you are installing Kaspersky Anti-Virus 2009 the folder \Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Anti-Virus 2009\English with the embedded files setup.exe and kav.en.msi
+ if you are installing Kaspersky Internet Security 2009 the folder \Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Internet Security 2009\English with the embedded files setup.exe and kis.en.msi
o for Windows Vista on the local disk C:\:
+ if you are installing Kaspersky Anti-Virus 2009 the folder \ProgramData\Kaspersky Lab Setup Files\Kaspersky Anti-Virus 2009\English with the embedded files setup.exe and kav.en.msi
+ if you are installing Kaspersky Internet Security 2009 the folder \ProgramData\Kaspersky Lab Setup Files\Kaspersky Internet Security 2009\English with the embedded files setup.exe and kis.en.msi
Information By default these folders are hidden and cannot be viewed. In order to view these folders, go to My Computer > in the Tools menu select Folder options. Go to the View and in the list enable the option Show hidden files and folders.
* Copy the files setup.exe and kav.en.msi/kis.en.msi (depending on the installed product) into the C:\ root directory
* Click Start > Run
* enter CMD and click OK
* enter [full path to setup.exe file] /pSKIPPRODUCTCHECK=1.
I found the overly complicated workaround on their FAQ (pasted below) but ran into these problems with it:
download from the link http://www.kaspersky.com/productupdates - Could not download it timed out.
In order to start Kaspersky Anti-Virus 2009\Kaspersky Internet Security 2009 and skip scan for incompatible software, do the following:
* download the distributive of the latest version of Kaspersky Anti-Virus 2009\ Kaspersky Internet Security 2009 from the link http://www.kaspersky.com/productupdates and save it on your PC.
* run the product installation
* in the Setup Wizard window click Cancel
make sure the following folder appeared on the local disc: \ProgramData\Kaspersky Lab Setup Files\Kaspersky Internet Security 2009\English with the embedded files setup.exe and kis.en.msi - not there
enter [full path to setup.exe file] /pSKIPPRODUCTCHECK=1 - failed
any ideas?
* make sure the following folder appeared on the local disc:
o for Windows XP on the local disk C:\:
+ if you are installing Kaspersky Anti-Virus 2009 the folder \Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Anti-Virus 2009\English with the embedded files setup.exe and kav.en.msi
+ if you are installing Kaspersky Internet Security 2009 the folder \Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Internet Security 2009\English with the embedded files setup.exe and kis.en.msi
o for Windows Vista on the local disk C:\:
+ if you are installing Kaspersky Anti-Virus 2009 the folder \ProgramData\Kaspersky Lab Setup Files\Kaspersky Anti-Virus 2009\English with the embedded files setup.exe and kav.en.msi
+ if you are installing Kaspersky Internet Security 2009 the folder \ProgramData\Kaspersky Lab Setup Files\Kaspersky Internet Security 2009\English with the embedded files setup.exe and kis.en.msi
Information By default these folders are hidden and cannot be viewed. In order to view these folders, go to My Computer > in the Tools menu select Folder options. Go to the View and in the list enable the option Show hidden files and folders.
* Copy the files setup.exe and kav.en.msi/kis.en.msi (depending on the installed product) into the C:\ root directory
* Click Start > Run
* enter CMD and click OK
* enter [full path to setup.exe file] /pSKIPPRODUCTCHECK=1.
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Got things screwed up on the last post .Corrected:
Thanks for the suggestion. I downloaded Kaspersky Internet Security 2009 trial version, uninstalled AVG Antivirus security and tried to install Kaspersky but it thinks AVG is still installed and will not install.
I found the overly complicated workaround on their FAQ (pasted below) but ran into these problems with it:
download from the link http://www.kaspersky.com/productupdates - Could not download - it timed out.
enter [full path to setup.exe file] /pSKIPPRODUCTCHECK=1 - failed
In order to start Kaspersky Anti-Virus 2009\Kaspersky Internet Security 2009 and skip scan for incompatible software, do the following:
* download the distributive of the latest version of Kaspersky Anti-Virus 2009\ Kaspersky Internet Security 2009 from the link http://www.kaspersky.com/productupdates and save it on your PC.
* run the product installation
* in the Setup Wizard window click Cancel
* make sure the following folder appeared on the local disc:
o for Windows XP on the local disk C:\:
+ if you are installing Kaspersky Anti-Virus 2009 the folder \Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Anti-Virus 2009\English with the embedded files setup.exe and kav.en.msi
+ if you are installing Kaspersky Internet Security 2009 the folder \Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Internet Security 2009\English with the embedded files setup.exe and kis.en.msi
o for Windows Vista on the local disk C:\:
+ if you are installing Kaspersky Anti-Virus 2009 the folder \ProgramData\Kaspersky Lab Setup Files\Kaspersky Anti-Virus 2009\English with the embedded files setup.exe and kav.en.msi
+ if you are installing Kaspersky Internet Security 2009 the folder \ProgramData\Kaspersky Lab Setup Files\Kaspersky Internet Security 2009\English with the embedded files setup.exe and kis.en.msi
Information By default these folders are hidden and cannot be viewed. In order to view these folders, go to My Computer > in the Tools menu select Folder options. Go to the View and in the list enable the option Show hidden files and folders.
* Copy the files setup.exe and kav.en.msi/kis.en.msi (depending on the installed product) into the C:\ root directory
* Click Start > Run
* enter CMD and click OK
* enter [full path to setup.exe file] /pSKIPPRODUCTCHECK=1.
Thanks for the suggestion. I downloaded Kaspersky Internet Security 2009 trial version, uninstalled AVG Antivirus security and tried to install Kaspersky but it thinks AVG is still installed and will not install.
I found the overly complicated workaround on their FAQ (pasted below) but ran into these problems with it:
download from the link http://www.kaspersky.com/productupdates - Could not download - it timed out.
enter [full path to setup.exe file] /pSKIPPRODUCTCHECK=1 - failed
In order to start Kaspersky Anti-Virus 2009\Kaspersky Internet Security 2009 and skip scan for incompatible software, do the following:
* download the distributive of the latest version of Kaspersky Anti-Virus 2009\ Kaspersky Internet Security 2009 from the link http://www.kaspersky.com/productupdates and save it on your PC.
* run the product installation
* in the Setup Wizard window click Cancel
* make sure the following folder appeared on the local disc:
o for Windows XP on the local disk C:\:
+ if you are installing Kaspersky Anti-Virus 2009 the folder \Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Anti-Virus 2009\English with the embedded files setup.exe and kav.en.msi
+ if you are installing Kaspersky Internet Security 2009 the folder \Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Internet Security 2009\English with the embedded files setup.exe and kis.en.msi
o for Windows Vista on the local disk C:\:
+ if you are installing Kaspersky Anti-Virus 2009 the folder \ProgramData\Kaspersky Lab Setup Files\Kaspersky Anti-Virus 2009\English with the embedded files setup.exe and kav.en.msi
+ if you are installing Kaspersky Internet Security 2009 the folder \ProgramData\Kaspersky Lab Setup Files\Kaspersky Internet Security 2009\English with the embedded files setup.exe and kis.en.msi
Information By default these folders are hidden and cannot be viewed. In order to view these folders, go to My Computer > in the Tools menu select Folder options. Go to the View and in the list enable the option Show hidden files and folders.
* Copy the files setup.exe and kav.en.msi/kis.en.msi (depending on the installed product) into the C:\ root directory
* Click Start > Run
* enter CMD and click OK
* enter [full path to setup.exe file] /pSKIPPRODUCTCHECK=1.
ASKER
>download this live cd : http://www.f-secure.com/linux-weblog/2008/11/25/rescuecd-301-released/
when you boot from it, it will first update the virus databse, then scan.
another option, is to connect your drive to a working PC, and scan it from there<
Are you sure? That link goes to Linux This computer is running Vista.
when you boot from it, it will first update the virus databse, then scan.
another option, is to connect your drive to a working PC, and scan it from there<
Are you sure? That link goes to Linux This computer is running Vista.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
>> That link goes to Linux This computer is running Vista. << THAT DOES NOT MATTTER AT ALL.
it does not ttouch or change your system, it only scans it
it does not ttouch or change your system, it only scans it
Running ComboFix might help with this. Download it from: http://www.bleepingcomputer.com/combofix/how-to-use-combofix
Disable your existing antivirus protection and run it. After ComboFix is done, re-enable your existing antivirus protection and send us the log. Then scan with MalwareBytes or SuperAntiSpyware again, this time they should work.
Disable your existing antivirus protection and run it. After ComboFix is done, re-enable your existing antivirus protection and send us the log. Then scan with MalwareBytes or SuperAntiSpyware again, this time they should work.
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Got Kaspersky Internet Security installed (had to manually remove AVG references in Registry). Kaspersky Internet Security will not run. I am downloading f-secure that nobus suggested now.
Kaspersky Internet Security will not run !!!!!!!! . can you tell me what the exact error message show to you ?
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
>Wareout in vista is easily removed by merely fixing the bad 017 entries showing in the Hijackthis log.<
Hijackthis will not run. I get this popup:
Clipboard01.gif
Hijackthis will not run. I get this popup:
Clipboard01.gif
that is why i suggested the live CD; try it. it's free
ASKER
OK, I renamed HijackThis, ran it and deleted all the 017 entries. Here is the log file (before deleting to 017 entries):
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:19:50 AM, on 5/21/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18226)
Boot mode: Normal
Running processes:
C:\Windows\system32\Dwm.ex
C:\Windows\system32\tasken
C:\Windows\Explorer.EXE
C:\Windows\SYSTEM32\WISPTI
C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
C:\Windows\System32\mobsyn
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Fujitsu\FUJ02E3\FUJ0
C:\Program Files\Fujitsu\SSUtility\FJ
C:\Program Files\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe
C:\Program Files\Fingerprint Sensor\ATSwpNav.exe
C:\Program Files\Softex\OmniPass\scur
C:\Windows\System32\hkcmd.
C:\Windows\System32\igfxpe
C:\Program Files\HEXelon MAX 6\hexelon.exe
C:\Program Files\Lexmark X5400 Series\lxdvmon.exe
C:\Program Files\Lexmark X5400 Series\lxdvamon.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\ClipMate7\ClipMate.e
C:\Program Files\Evernote\ritePen\Rit
C:\Program Files\TweakVI\TweakVI.exe
C:\Windows\system32\igfxsr
C:\Program Files\FireTrust\Benign\B9.
D:\Utilities\BatteryAlarm.
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
C:\Program Files\FireTrust\MailWasher
C:\Program Files\Fujitsu\Utils\FjDspM
C:\Program Files\Fujitsu\Utils\fjeven
C:\Program Files\Fujitsu\Utils\FjMenu
C:\Windows\system32\igfxex
C:\Program Files\Fujitsu\Utils\FjIrKb
C:\Program Files\Windows Sidebar\sidebar.exe
c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe
c:\Program Files\Toshiba\Bluetooth Toshiba Stack\tosOBEX.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtProc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonaliz
C:\Windows\temp\467774286.
C:\Windows\system32\Search
C:\Program Files\VCOM\PowerDesk\PDExp
D:\My Documents\Downloads\Temp download\ht.exe
D:\My Documents\Downloads\Temp download\ht.exe
C:\Users\Nelson\Desktop\ht
R1 - HKCU\Software\Microsoft\In
R1 - HKCU\Software\Microsoft\In
R0 - HKCU\Software\Microsoft\In
R1 - HKLM\Software\Microsoft\In
R1 - HKLM\Software\Microsoft\In
R1 - HKLM\Software\Microsoft\In
R0 - HKLM\Software\Microsoft\In
R0 - HKLM\Software\Microsoft\In
R0 - HKLM\Software\Microsoft\In
O1 - Hosts: ::1 localhost
O1 - Hosts: 127.98.9.2 mail.thenelson.name.b9
O1 - Hosts: 127.98.9.1 mail.nosuffering.com.b9
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-7
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6
O2 - BHO: RoboForm - {724d43a9-0d85-11d4-9908-0
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-0
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [LoadFUJ02E3] C:\Program Files\Fujitsu\FUJ02E3\FUJ0
O4 - HKLM\..\Run: [SSUtility] C:\Program Files\Fujitsu\SSUtility\FJ
O4 - HKLM\..\Run: [FjStrtAp] C:\Program Files\Fujitsu\Utils\FjStrt
O4 - HKLM\..\Run: [IndicatorUtility] C:\Program Files\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe
O4 - HKLM\..\Run: [ATSwpNav] "C:\Program Files\Fingerprint Sensor\ATSwpNav" -run
O4 - HKLM\..\Run: [OmniPass] C:\Program Files\Softex\OmniPass\scur
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] sttray.exe
O4 - HKLM\..\Run: [HEXelon MAX] "C:\PROGRA~1\HEXELO~1\hexe
O4 - HKLM\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKLM\..\Run: [lxdvmon.exe] "C:\Program Files\Lexmark X5400 Series\lxdvmon.exe"
O4 - HKLM\..\Run: [lxdvamon] "C:\Program Files\Lexmark X5400 Series\lxdvamon.exe"
O4 - HKLM\..\Run: [Lexmark X5400 Series Fax Server] "C:\Program Files\Lexmark X5400 Series\fm3032.exe" /s
O4 - HKLM\..\Run: [FileAnt] C:\Program Files\FileAnt\FileAnt.exe
O4 - HKLM\..\Run: [Intuit SyncManager] C:\Program Files\Common Files\Intuit\Sync\IntuitSy
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ClipMate7] C:\Program Files\ClipMate7\ClipMate.e
O4 - HKCU\..\Run: [ritePen] C:\Program Files\Evernote\ritePen\Rit
O4 - HKCU\..\Run: [TweakVI] "C:\Program Files\TweakVI\tweakvi.exe"
O4 - HKCU\..\Run: [b9] "C:\Program Files\FireTrust\Benign\B9.
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCe
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync
O4 - Startup: BatteryAlarm.lnk = D:\Utilities\BatteryAlarm.
O4 - Startup: Bluetooth Manager.lnk = ?
O4 - Startup: MailWasherPro.lnk = C:\Program Files\FireTrust\MailWasher
O4 - Startup: Microsoft Office Outlook 2003.lnk = ?
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync
O4 - Global Startup: BatteryAlarm.lnk = D:\Utilities\BatteryAlarm.
O4 - Global Startup: Bluetooth Manager.lnk = ?
O4 - Global Startup: MailWasherPro.lnk = C:\Program Files\FireTrust\MailWasher
O4 - Global Startup: Microsoft Office Outlook 2003.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2
O8 - Extra context menu item: Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillFo
O8 - Extra context menu item: RoboForm Toolbar - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowTo
O8 - Extra context menu item: Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePa
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-0
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-0
O9 - Extra button: Web traffic protection statistics - {1F460357-8A94-4D71-9CA3-A
O9 - Extra button: @C:\Windows\WindowsMobile\
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-0
O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C
O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C
O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C
O9 - Extra button: Customize - {320AF880-6646-11D3-ABEE-C
O9 - Extra 'Tools' menuitem: Customize Menu - {320AF880-6646-11D3-ABEE-C
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-0
O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-0
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3
O9 - Extra button: PDFill PDF Editor - {FB858B22-55E2-413f-87F5-3
O13 - Gopher Prefix:
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-4
O17 - HKLM\System\CCS\Services\T
O17 - HKLM\System\CCS\Services\T
O17 - HKLM\System\CCS\Services\T
O17 - HKLM\System\CS1\Services\T
O17 - HKLM\System\CCS\Services\T
O18 - Protocol: intu-help-qb2 - {84D77A00-41B5-4B8B-8ADF-8
O18 - Protocol: qbwc - {FC598A64-626C-4447-85B8-5
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPE
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsms
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
O23 - Service: lxdvCATSCustConnectService
O23 - Service: lxdv_device - - C:\Windows\system32\lxdvco
O23 - Service: O2Flash Memory Service (O2Flash) - O2Micro International - C:\Windows\system32\o2flas
O23 - Service: Softex OmniPass Service (omniserv) - Softex Inc. - C:\Program Files\Softex\OmniPass\Omni
O23 - Service: QBCFMonitorService - Intuit - C:\Program Files\Common Files\Intuit\QuickBooks\QB
O23 - Service: Intuit QuickBooks FCS (QBFCService) - Intuit Inc. - C:\Program Files\Common Files\Intuit\QuickBooks\FC
O23 - Service: TabletService - Wacom Technology, Corp. - C:\Windows\system32\Tablet
O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
O23 - Service: UpdateNaviInstallService - FUJITSU LIMITED - C:\Program Files\Fujitsu\fjdvrupd\upd
--
End of file - 12519 bytes
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:19:50 AM, on 5/21/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18226)
Boot mode: Normal
Running processes:
C:\Windows\system32\Dwm.ex
C:\Windows\system32\tasken
C:\Windows\Explorer.EXE
C:\Windows\SYSTEM32\WISPTI
C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
C:\Windows\System32\mobsyn
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Fujitsu\FUJ02E3\FUJ0
C:\Program Files\Fujitsu\SSUtility\FJ
C:\Program Files\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe
C:\Program Files\Fingerprint Sensor\ATSwpNav.exe
C:\Program Files\Softex\OmniPass\scur
C:\Windows\System32\hkcmd.
C:\Windows\System32\igfxpe
C:\Program Files\HEXelon MAX 6\hexelon.exe
C:\Program Files\Lexmark X5400 Series\lxdvmon.exe
C:\Program Files\Lexmark X5400 Series\lxdvamon.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\ClipMate7\ClipMate.e
C:\Program Files\Evernote\ritePen\Rit
C:\Program Files\TweakVI\TweakVI.exe
C:\Windows\system32\igfxsr
C:\Program Files\FireTrust\Benign\B9.
D:\Utilities\BatteryAlarm.
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
C:\Program Files\FireTrust\MailWasher
C:\Program Files\Fujitsu\Utils\FjDspM
C:\Program Files\Fujitsu\Utils\fjeven
C:\Program Files\Fujitsu\Utils\FjMenu
C:\Windows\system32\igfxex
C:\Program Files\Fujitsu\Utils\FjIrKb
C:\Program Files\Windows Sidebar\sidebar.exe
c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe
c:\Program Files\Toshiba\Bluetooth Toshiba Stack\tosOBEX.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtProc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonaliz
C:\Windows\temp\467774286.
C:\Windows\system32\Search
C:\Program Files\VCOM\PowerDesk\PDExp
D:\My Documents\Downloads\Temp download\ht.exe
D:\My Documents\Downloads\Temp download\ht.exe
C:\Users\Nelson\Desktop\ht
R1 - HKCU\Software\Microsoft\In
R1 - HKCU\Software\Microsoft\In
R0 - HKCU\Software\Microsoft\In
R1 - HKLM\Software\Microsoft\In
R1 - HKLM\Software\Microsoft\In
R1 - HKLM\Software\Microsoft\In
R0 - HKLM\Software\Microsoft\In
R0 - HKLM\Software\Microsoft\In
R0 - HKLM\Software\Microsoft\In
O1 - Hosts: ::1 localhost
O1 - Hosts: 127.98.9.2 mail.thenelson.name.b9
O1 - Hosts: 127.98.9.1 mail.nosuffering.com.b9
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-7
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6
O2 - BHO: RoboForm - {724d43a9-0d85-11d4-9908-0
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-0
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [LoadFUJ02E3] C:\Program Files\Fujitsu\FUJ02E3\FUJ0
O4 - HKLM\..\Run: [SSUtility] C:\Program Files\Fujitsu\SSUtility\FJ
O4 - HKLM\..\Run: [FjStrtAp] C:\Program Files\Fujitsu\Utils\FjStrt
O4 - HKLM\..\Run: [IndicatorUtility] C:\Program Files\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe
O4 - HKLM\..\Run: [ATSwpNav] "C:\Program Files\Fingerprint Sensor\ATSwpNav" -run
O4 - HKLM\..\Run: [OmniPass] C:\Program Files\Softex\OmniPass\scur
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] sttray.exe
O4 - HKLM\..\Run: [HEXelon MAX] "C:\PROGRA~1\HEXELO~1\hexe
O4 - HKLM\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKLM\..\Run: [lxdvmon.exe] "C:\Program Files\Lexmark X5400 Series\lxdvmon.exe"
O4 - HKLM\..\Run: [lxdvamon] "C:\Program Files\Lexmark X5400 Series\lxdvamon.exe"
O4 - HKLM\..\Run: [Lexmark X5400 Series Fax Server] "C:\Program Files\Lexmark X5400 Series\fm3032.exe" /s
O4 - HKLM\..\Run: [FileAnt] C:\Program Files\FileAnt\FileAnt.exe
O4 - HKLM\..\Run: [Intuit SyncManager] C:\Program Files\Common Files\Intuit\Sync\IntuitSy
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ClipMate7] C:\Program Files\ClipMate7\ClipMate.e
O4 - HKCU\..\Run: [ritePen] C:\Program Files\Evernote\ritePen\Rit
O4 - HKCU\..\Run: [TweakVI] "C:\Program Files\TweakVI\tweakvi.exe"
O4 - HKCU\..\Run: [b9] "C:\Program Files\FireTrust\Benign\B9.
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCe
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync
O4 - Startup: BatteryAlarm.lnk = D:\Utilities\BatteryAlarm.
O4 - Startup: Bluetooth Manager.lnk = ?
O4 - Startup: MailWasherPro.lnk = C:\Program Files\FireTrust\MailWasher
O4 - Startup: Microsoft Office Outlook 2003.lnk = ?
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync
O4 - Global Startup: BatteryAlarm.lnk = D:\Utilities\BatteryAlarm.
O4 - Global Startup: Bluetooth Manager.lnk = ?
O4 - Global Startup: MailWasherPro.lnk = C:\Program Files\FireTrust\MailWasher
O4 - Global Startup: Microsoft Office Outlook 2003.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2
O8 - Extra context menu item: Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillFo
O8 - Extra context menu item: RoboForm Toolbar - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowTo
O8 - Extra context menu item: Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePa
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-0
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-0
O9 - Extra button: Web traffic protection statistics - {1F460357-8A94-4D71-9CA3-A
O9 - Extra button: @C:\Windows\WindowsMobile\
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-0
O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C
O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C
O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C
O9 - Extra button: Customize - {320AF880-6646-11D3-ABEE-C
O9 - Extra 'Tools' menuitem: Customize Menu - {320AF880-6646-11D3-ABEE-C
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-0
O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-0
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3
O9 - Extra button: PDFill PDF Editor - {FB858B22-55E2-413f-87F5-3
O13 - Gopher Prefix:
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-4
O17 - HKLM\System\CCS\Services\T
O17 - HKLM\System\CCS\Services\T
O17 - HKLM\System\CCS\Services\T
O17 - HKLM\System\CS1\Services\T
O17 - HKLM\System\CCS\Services\T
O18 - Protocol: intu-help-qb2 - {84D77A00-41B5-4B8B-8ADF-8
O18 - Protocol: qbwc - {FC598A64-626C-4447-85B8-5
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPE
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsms
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
O23 - Service: lxdvCATSCustConnectService
O23 - Service: lxdv_device - - C:\Windows\system32\lxdvco
O23 - Service: O2Flash Memory Service (O2Flash) - O2Micro International - C:\Windows\system32\o2flas
O23 - Service: Softex OmniPass Service (omniserv) - Softex Inc. - C:\Program Files\Softex\OmniPass\Omni
O23 - Service: QBCFMonitorService - Intuit - C:\Program Files\Common Files\Intuit\QuickBooks\QB
O23 - Service: Intuit QuickBooks FCS (QBFCService) - Intuit Inc. - C:\Program Files\Common Files\Intuit\QuickBooks\FC
O23 - Service: TabletService - Wacom Technology, Corp. - C:\Windows\system32\Tablet
O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
O23 - Service: UpdateNaviInstallService - FUJITSU LIMITED - C:\Program Files\Fujitsu\fjdvrupd\upd
--
End of file - 12519 bytes
ASKER
Still downloading f-secure.
>Kaspersky Internet Security will not run !!!!!!!! . can you tell me what the exact error message show to you ?<
No error message - clicking on it does nothing. Will try again now that I deleted the 017 entries after rebooting.
>Kaspersky Internet Security will not run !!!!!!!! . can you tell me what the exact error message show to you ?<
No error message - clicking on it does nothing. Will try again now that I deleted the 017 entries after rebooting.
ASKER
>Kaspersky Internet Security will not run !!!!!!!! . can you tell me what the exact error message show to you ?<
Now that I rebooted after deleting the 017 entries, I get a popup stating "Kaspersky Anti Virus has stopped working".
Now that I rebooted after deleting the 017 entries, I get a popup stating "Kaspersky Anti Virus has stopped working".
Strange entry in HijackThis log:
C:\Windows\temp\467774286.
You might have a rootkit operating in the background. You can try ComboFix as suggested earlier, it might help.
C:\Windows\temp\467774286.
You might have a rootkit operating in the background. You can try ComboFix as suggested earlier, it might help.
ASKER
Ran Malwarebytes' Anti-Malware. C:\Windows\temp\467774286.
Here is the latest HijackThis log:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:19:50 AM, on 5/21/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18226)
Boot mode: Normal
Running processes:
C:\Windows\system32\Dwm.ex
C:\Windows\system32\tasken
C:\Windows\Explorer.EXE
C:\Windows\SYSTEM32\WISPTI
C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
C:\Windows\System32\mobsyn
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Fujitsu\FUJ02E3\FUJ0
C:\Program Files\Fujitsu\SSUtility\FJ
C:\Program Files\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe
C:\Program Files\Fingerprint Sensor\ATSwpNav.exe
C:\Program Files\Softex\OmniPass\scur
C:\Windows\System32\hkcmd.
C:\Windows\System32\igfxpe
C:\Program Files\HEXelon MAX 6\hexelon.exe
C:\Program Files\Lexmark X5400 Series\lxdvmon.exe
C:\Program Files\Lexmark X5400 Series\lxdvamon.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\ClipMate7\ClipMate.e
C:\Program Files\Evernote\ritePen\Rit
C:\Program Files\TweakVI\TweakVI.exe
C:\Windows\system32\igfxsr
C:\Program Files\FireTrust\Benign\B9.
D:\Utilities\BatteryAlarm.
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
C:\Program Files\FireTrust\MailWasher
C:\Program Files\Fujitsu\Utils\FjDspM
C:\Program Files\Fujitsu\Utils\fjeven
C:\Program Files\Fujitsu\Utils\FjMenu
C:\Windows\system32\igfxex
C:\Program Files\Fujitsu\Utils\FjIrKb
C:\Program Files\Windows Sidebar\sidebar.exe
c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe
c:\Program Files\Toshiba\Bluetooth Toshiba Stack\tosOBEX.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtProc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonaliz
C:\Windows\temp\467774286.
C:\Windows\system32\Search
C:\Program Files\VCOM\PowerDesk\PDExp
D:\My Documents\Downloads\Temp download\ht.exe
D:\My Documents\Downloads\Temp download\ht.exe
C:\Users\Nelson\Desktop\ht
R1 - HKCU\Software\Microsoft\In
R1 - HKCU\Software\Microsoft\In
R0 - HKCU\Software\Microsoft\In
R1 - HKLM\Software\Microsoft\In
R1 - HKLM\Software\Microsoft\In
R1 - HKLM\Software\Microsoft\In
R0 - HKLM\Software\Microsoft\In
R0 - HKLM\Software\Microsoft\In
R0 - HKLM\Software\Microsoft\In
O1 - Hosts: ::1 localhost
O1 - Hosts: 127.98.9.2 mail.thenelson.name.b9
O1 - Hosts: 127.98.9.1 mail.nosuffering.com.b9
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-7
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6
O2 - BHO: RoboForm - {724d43a9-0d85-11d4-9908-0
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-0
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [LoadFUJ02E3] C:\Program Files\Fujitsu\FUJ02E3\FUJ0
O4 - HKLM\..\Run: [SSUtility] C:\Program Files\Fujitsu\SSUtility\FJ
O4 - HKLM\..\Run: [FjStrtAp] C:\Program Files\Fujitsu\Utils\FjStrt
O4 - HKLM\..\Run: [IndicatorUtility] C:\Program Files\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe
O4 - HKLM\..\Run: [ATSwpNav] "C:\Program Files\Fingerprint Sensor\ATSwpNav" -run
O4 - HKLM\..\Run: [OmniPass] C:\Program Files\Softex\OmniPass\scur
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] sttray.exe
O4 - HKLM\..\Run: [HEXelon MAX] "C:\PROGRA~1\HEXELO~1\hexe
O4 - HKLM\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKLM\..\Run: [lxdvmon.exe] "C:\Program Files\Lexmark X5400 Series\lxdvmon.exe"
O4 - HKLM\..\Run: [lxdvamon] "C:\Program Files\Lexmark X5400 Series\lxdvamon.exe"
O4 - HKLM\..\Run: [Lexmark X5400 Series Fax Server] "C:\Program Files\Lexmark X5400 Series\fm3032.exe" /s
O4 - HKLM\..\Run: [FileAnt] C:\Program Files\FileAnt\FileAnt.exe
O4 - HKLM\..\Run: [Intuit SyncManager] C:\Program Files\Common Files\Intuit\Sync\IntuitSy
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ClipMate7] C:\Program Files\ClipMate7\ClipMate.e
O4 - HKCU\..\Run: [ritePen] C:\Program Files\Evernote\ritePen\Rit
O4 - HKCU\..\Run: [TweakVI] "C:\Program Files\TweakVI\tweakvi.exe"
O4 - HKCU\..\Run: [b9] "C:\Program Files\FireTrust\Benign\B9.
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCe
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync
O4 - Startup: BatteryAlarm.lnk = D:\Utilities\BatteryAlarm.
O4 - Startup: Bluetooth Manager.lnk = ?
O4 - Startup: MailWasherPro.lnk = C:\Program Files\FireTrust\MailWasher
O4 - Startup: Microsoft Office Outlook 2003.lnk = ?
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync
O4 - Global Startup: BatteryAlarm.lnk = D:\Utilities\BatteryAlarm.
O4 - Global Startup: Bluetooth Manager.lnk = ?
O4 - Global Startup: MailWasherPro.lnk = C:\Program Files\FireTrust\MailWasher
O4 - Global Startup: Microsoft Office Outlook 2003.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2
O8 - Extra context menu item: Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillFo
O8 - Extra context menu item: RoboForm Toolbar - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowTo
O8 - Extra context menu item: Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePa
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-0
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-0
O9 - Extra button: Web traffic protection statistics - {1F460357-8A94-4D71-9CA3-A
O9 - Extra button: @C:\Windows\WindowsMobile\
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-0
O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C
O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C
O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C
O9 - Extra button: Customize - {320AF880-6646-11D3-ABEE-C
O9 - Extra 'Tools' menuitem: Customize Menu - {320AF880-6646-11D3-ABEE-C
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-0
O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-0
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3
O9 - Extra button: PDFill PDF Editor - {FB858B22-55E2-413f-87F5-3
O13 - Gopher Prefix:
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-4
O17 - HKLM\System\CCS\Services\T
O17 - HKLM\System\CCS\Services\T
O17 - HKLM\System\CCS\Services\T
O17 - HKLM\System\CS1\Services\T
O17 - HKLM\System\CCS\Services\T
O18 - Protocol: intu-help-qb2 - {84D77A00-41B5-4B8B-8ADF-8
O18 - Protocol: qbwc - {FC598A64-626C-4447-85B8-5
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPE
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsms
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
O23 - Service: lxdvCATSCustConnectService
O23 - Service: lxdv_device - - C:\Windows\system32\lxdvco
O23 - Service: O2Flash Memory Service (O2Flash) - O2Micro International - C:\Windows\system32\o2flas
O23 - Service: Softex OmniPass Service (omniserv) - Softex Inc. - C:\Program Files\Softex\OmniPass\Omni
O23 - Service: QBCFMonitorService - Intuit - C:\Program Files\Common Files\Intuit\QuickBooks\QB
O23 - Service: Intuit QuickBooks FCS (QBFCService) - Intuit Inc. - C:\Program Files\Common Files\Intuit\QuickBooks\FC
O23 - Service: TabletService - Wacom Technology, Corp. - C:\Windows\system32\Tablet
O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
O23 - Service: UpdateNaviInstallService - FUJITSU LIMITED - C:\Program Files\Fujitsu\fjdvrupd\upd
--
End of file - 12519 bytes
Here is the latest HijackThis log:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:19:50 AM, on 5/21/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18226)
Boot mode: Normal
Running processes:
C:\Windows\system32\Dwm.ex
C:\Windows\system32\tasken
C:\Windows\Explorer.EXE
C:\Windows\SYSTEM32\WISPTI
C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
C:\Windows\System32\mobsyn
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Fujitsu\FUJ02E3\FUJ0
C:\Program Files\Fujitsu\SSUtility\FJ
C:\Program Files\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe
C:\Program Files\Fingerprint Sensor\ATSwpNav.exe
C:\Program Files\Softex\OmniPass\scur
C:\Windows\System32\hkcmd.
C:\Windows\System32\igfxpe
C:\Program Files\HEXelon MAX 6\hexelon.exe
C:\Program Files\Lexmark X5400 Series\lxdvmon.exe
C:\Program Files\Lexmark X5400 Series\lxdvamon.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\ClipMate7\ClipMate.e
C:\Program Files\Evernote\ritePen\Rit
C:\Program Files\TweakVI\TweakVI.exe
C:\Windows\system32\igfxsr
C:\Program Files\FireTrust\Benign\B9.
D:\Utilities\BatteryAlarm.
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
C:\Program Files\FireTrust\MailWasher
C:\Program Files\Fujitsu\Utils\FjDspM
C:\Program Files\Fujitsu\Utils\fjeven
C:\Program Files\Fujitsu\Utils\FjMenu
C:\Windows\system32\igfxex
C:\Program Files\Fujitsu\Utils\FjIrKb
C:\Program Files\Windows Sidebar\sidebar.exe
c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe
c:\Program Files\Toshiba\Bluetooth Toshiba Stack\tosOBEX.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtProc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonaliz
C:\Windows\temp\467774286.
C:\Windows\system32\Search
C:\Program Files\VCOM\PowerDesk\PDExp
D:\My Documents\Downloads\Temp download\ht.exe
D:\My Documents\Downloads\Temp download\ht.exe
C:\Users\Nelson\Desktop\ht
R1 - HKCU\Software\Microsoft\In
R1 - HKCU\Software\Microsoft\In
R0 - HKCU\Software\Microsoft\In
R1 - HKLM\Software\Microsoft\In
R1 - HKLM\Software\Microsoft\In
R1 - HKLM\Software\Microsoft\In
R0 - HKLM\Software\Microsoft\In
R0 - HKLM\Software\Microsoft\In
R0 - HKLM\Software\Microsoft\In
O1 - Hosts: ::1 localhost
O1 - Hosts: 127.98.9.2 mail.thenelson.name.b9
O1 - Hosts: 127.98.9.1 mail.nosuffering.com.b9
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-7
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6
O2 - BHO: RoboForm - {724d43a9-0d85-11d4-9908-0
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-0
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [LoadFUJ02E3] C:\Program Files\Fujitsu\FUJ02E3\FUJ0
O4 - HKLM\..\Run: [SSUtility] C:\Program Files\Fujitsu\SSUtility\FJ
O4 - HKLM\..\Run: [FjStrtAp] C:\Program Files\Fujitsu\Utils\FjStrt
O4 - HKLM\..\Run: [IndicatorUtility] C:\Program Files\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe
O4 - HKLM\..\Run: [ATSwpNav] "C:\Program Files\Fingerprint Sensor\ATSwpNav" -run
O4 - HKLM\..\Run: [OmniPass] C:\Program Files\Softex\OmniPass\scur
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] sttray.exe
O4 - HKLM\..\Run: [HEXelon MAX] "C:\PROGRA~1\HEXELO~1\hexe
O4 - HKLM\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKLM\..\Run: [lxdvmon.exe] "C:\Program Files\Lexmark X5400 Series\lxdvmon.exe"
O4 - HKLM\..\Run: [lxdvamon] "C:\Program Files\Lexmark X5400 Series\lxdvamon.exe"
O4 - HKLM\..\Run: [Lexmark X5400 Series Fax Server] "C:\Program Files\Lexmark X5400 Series\fm3032.exe" /s
O4 - HKLM\..\Run: [FileAnt] C:\Program Files\FileAnt\FileAnt.exe
O4 - HKLM\..\Run: [Intuit SyncManager] C:\Program Files\Common Files\Intuit\Sync\IntuitSy
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ClipMate7] C:\Program Files\ClipMate7\ClipMate.e
O4 - HKCU\..\Run: [ritePen] C:\Program Files\Evernote\ritePen\Rit
O4 - HKCU\..\Run: [TweakVI] "C:\Program Files\TweakVI\tweakvi.exe"
O4 - HKCU\..\Run: [b9] "C:\Program Files\FireTrust\Benign\B9.
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCe
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync
O4 - Startup: BatteryAlarm.lnk = D:\Utilities\BatteryAlarm.
O4 - Startup: Bluetooth Manager.lnk = ?
O4 - Startup: MailWasherPro.lnk = C:\Program Files\FireTrust\MailWasher
O4 - Startup: Microsoft Office Outlook 2003.lnk = ?
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync
O4 - Global Startup: BatteryAlarm.lnk = D:\Utilities\BatteryAlarm.
O4 - Global Startup: Bluetooth Manager.lnk = ?
O4 - Global Startup: MailWasherPro.lnk = C:\Program Files\FireTrust\MailWasher
O4 - Global Startup: Microsoft Office Outlook 2003.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2
O8 - Extra context menu item: Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillFo
O8 - Extra context menu item: RoboForm Toolbar - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowTo
O8 - Extra context menu item: Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePa
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-0
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-0
O9 - Extra button: Web traffic protection statistics - {1F460357-8A94-4D71-9CA3-A
O9 - Extra button: @C:\Windows\WindowsMobile\
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-0
O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C
O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C
O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C
O9 - Extra button: Customize - {320AF880-6646-11D3-ABEE-C
O9 - Extra 'Tools' menuitem: Customize Menu - {320AF880-6646-11D3-ABEE-C
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-0
O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-0
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3
O9 - Extra button: PDFill PDF Editor - {FB858B22-55E2-413f-87F5-3
O13 - Gopher Prefix:
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-4
O17 - HKLM\System\CCS\Services\T
O17 - HKLM\System\CCS\Services\T
O17 - HKLM\System\CCS\Services\T
O17 - HKLM\System\CS1\Services\T
O17 - HKLM\System\CCS\Services\T
O18 - Protocol: intu-help-qb2 - {84D77A00-41B5-4B8B-8ADF-8
O18 - Protocol: qbwc - {FC598A64-626C-4447-85B8-5
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPE
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsms
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
O23 - Service: lxdvCATSCustConnectService
O23 - Service: lxdv_device - - C:\Windows\system32\lxdvco
O23 - Service: O2Flash Memory Service (O2Flash) - O2Micro International - C:\Windows\system32\o2flas
O23 - Service: Softex OmniPass Service (omniserv) - Softex Inc. - C:\Program Files\Softex\OmniPass\Omni
O23 - Service: QBCFMonitorService - Intuit - C:\Program Files\Common Files\Intuit\QuickBooks\QB
O23 - Service: Intuit QuickBooks FCS (QBFCService) - Intuit Inc. - C:\Program Files\Common Files\Intuit\QuickBooks\FC
O23 - Service: TabletService - Wacom Technology, Corp. - C:\Windows\system32\Tablet
O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
O23 - Service: UpdateNaviInstallService - FUJITSU LIMITED - C:\Program Files\Fujitsu\fjdvrupd\upd
--
End of file - 12519 bytes
Those 017 entries are still there.
You have Tea timer, can you disable it before fixing entries in Hijackthis... registry monitoring programs tend to interfere with hijackthis.
Because of that running process in the temp folder, very likely that some nasties are lurking there.... a lot of nasties can hide from the Hijackthis scan.... so scanning with other tools like combofix etc is a good idea.
You have Tea timer, can you disable it before fixing entries in Hijackthis... registry monitoring programs tend to interfere with hijackthis.
Because of that running process in the temp folder, very likely that some nasties are lurking there.... a lot of nasties can hide from the Hijackthis scan.... so scanning with other tools like combofix etc is a good idea.
ASKER
They're not there now. Here is the HijackThis by after HijackThis, Malwarebytes and Kaspersky Internet Security:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:40:16 PM, on 5/21/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18226)
Boot mode: Normal
Running processes:
C:\Windows\system32\tasken
C:\Windows\SYSTEM32\WISPTI
C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
C:\Windows\system32\Dwm.ex
C:\Windows\Explorer.EXE
C:\Windows\system32\WTable
C:\Windows\System32\mobsyn
C:\Program Files\Fujitsu\FUJ02E3\FUJ0
C:\Program Files\Fujitsu\SSUtility\FJ
C:\Program Files\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe
C:\Program Files\Fingerprint Sensor\ATSwpNav.exe
C:\Program Files\Softex\OmniPass\scur
C:\Windows\System32\hkcmd.
C:\Windows\System32\igfxpe
C:\Program Files\HEXelon MAX 6\hexelon.exe
C:\Program Files\Lexmark X5400 Series\lxdvmon.exe
C:\Windows\system32\igfxsr
C:\Program Files\Lexmark X5400 Series\lxdvamon.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\ClipMate7\ClipMate.e
C:\Program Files\Evernote\ritePen\Rit
C:\Program Files\TweakVI\TweakVI.exe
C:\Program Files\FireTrust\Benign\B9.
D:\Utilities\BatteryAlarm.
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\FireTrust\MailWasher
C:\Program Files\Fujitsu\Utils\FjDspM
C:\Program Files\Fujitsu\Utils\fjeven
C:\Program Files\Fujitsu\Utils\FjMenu
C:\Windows\system32\igfxex
C:\Program Files\Fujitsu\Utils\FjIrKb
c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe
C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonaliz
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\VCOM\PowerDesk\PDExp
C:\PROGRA~1\MICROS~2\OFFIC
C:\Program Files\Windows Media Player\wmplayer.exe
c:\Program Files\Toshiba\Bluetooth Toshiba Stack\tosOBEX.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtProc.exe
C:\Users\Nelson\Desktop\ht
R0 - HKCU\Software\Microsoft\In
R1 - HKLM\Software\Microsoft\In
R1 - HKLM\Software\Microsoft\In
R1 - HKLM\Software\Microsoft\In
R0 - HKLM\Software\Microsoft\In
O1 - Hosts: ::1 localhost
O1 - Hosts: 127.98.9.2 mail.thenelson.name.b9
O1 - Hosts: 127.98.9.1 mail.nosuffering.com.b9
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-7
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6
O2 - BHO: RoboForm - {724d43a9-0d85-11d4-9908-0
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-0
O4 - HKLM\..\Run: [LoadFUJ02E3] C:\Program Files\Fujitsu\FUJ02E3\FUJ0
O4 - HKLM\..\Run: [SSUtility] C:\Program Files\Fujitsu\SSUtility\FJ
O4 - HKLM\..\Run: [FjStrtAp] C:\Program Files\Fujitsu\Utils\FjStrt
O4 - HKLM\..\Run: [IndicatorUtility] C:\Program Files\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe
O4 - HKLM\..\Run: [ATSwpNav] "C:\Program Files\Fingerprint Sensor\ATSwpNav" -run
O4 - HKLM\..\Run: [OmniPass] C:\Program Files\Softex\OmniPass\scur
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpe
O4 - HKLM\..\Run: [HEXelon MAX] "C:\PROGRA~1\HEXELO~1\hexe
O4 - HKLM\..\Run: [lxdvmon.exe] "C:\Program Files\Lexmark X5400 Series\lxdvmon.exe"
O4 - HKLM\..\Run: [lxdvamon] "C:\Program Files\Lexmark X5400 Series\lxdvamon.exe"
O4 - HKLM\..\Run: [Lexmark X5400 Series Fax Server] "C:\Program Files\Lexmark X5400 Series\fm3032.exe" /s
O4 - HKLM\..\Run: [Intuit SyncManager] C:\Program Files\Common Files\Intuit\Sync\IntuitSy
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ClipMate7] C:\Program Files\ClipMate7\ClipMate.e
O4 - HKCU\..\Run: [ritePen] C:\Program Files\Evernote\ritePen\Rit
O4 - HKCU\..\Run: [TweakVI] "C:\Program Files\TweakVI\tweakvi.exe"
O4 - HKCU\..\Run: [b9] "C:\Program Files\FireTrust\Benign\B9.
O4 - Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync
O4 - Startup: BatteryAlarm.lnk = D:\Utilities\BatteryAlarm.
O4 - Startup: Bluetooth Manager.lnk = ?
O4 - Startup: MailWasherPro.lnk = C:\Program Files\FireTrust\MailWasher
O4 - Startup: Microsoft Office Outlook 2003.lnk = ?
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync
O4 - Global Startup: BatteryAlarm.lnk = D:\Utilities\BatteryAlarm.
O4 - Global Startup: Bluetooth Manager.lnk = ?
O4 - Global Startup: MailWasherPro.lnk = C:\Program Files\FireTrust\MailWasher
O4 - Global Startup: Microsoft Office Outlook 2003.lnk = ?
O8 - Extra context menu item: Add to Banner Ad Blocker - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2
O8 - Extra context menu item: Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillFo
O8 - Extra context menu item: RoboForm Toolbar - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowTo
O8 - Extra context menu item: Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePa
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-0
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-0
O9 - Extra button: Web traffic protection statistics - {1F460357-8A94-4D71-9CA3-A
O9 - Extra button: @C:\Windows\WindowsMobile\
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-0
O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C
O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C
O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C
O9 - Extra button: Customize - {320AF880-6646-11D3-ABEE-C
O9 - Extra 'Tools' menuitem: Customize Menu - {320AF880-6646-11D3-ABEE-C
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-0
O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-0
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3
O9 - Extra button: PDFill PDF Editor - {FB858B22-55E2-413f-87F5-3
O13 - Gopher Prefix:
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-4
O18 - Protocol: intu-help-qb2 - {84D77A00-41B5-4B8B-8ADF-8
O18 - Protocol: qbwc - {FC598A64-626C-4447-85B8-5
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPE
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsms
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
O23 - Service: lxdvCATSCustConnectService
O23 - Service: lxdv_device - - C:\Windows\system32\lxdvco
O23 - Service: O2Flash Memory Service (O2Flash) - O2Micro International - C:\Windows\system32\o2flas
O23 - Service: Softex OmniPass Service (omniserv) - Softex Inc. - C:\Program Files\Softex\OmniPass\Omni
O23 - Service: QBCFMonitorService - Intuit - C:\Program Files\Common Files\Intuit\QuickBooks\QB
O23 - Service: Intuit QuickBooks FCS (QBFCService) - Intuit Inc. - C:\Program Files\Common Files\Intuit\QuickBooks\FC
O23 - Service: TabletService - Wacom Technology, Corp. - C:\Windows\system32\Tablet
O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
O23 - Service: UpdateNaviInstallService - FUJITSU LIMITED - C:\Program Files\Fujitsu\fjdvrupd\upd
--
End of file - 11012 bytes
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:40:16 PM, on 5/21/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18226)
Boot mode: Normal
Running processes:
C:\Windows\system32\tasken
C:\Windows\SYSTEM32\WISPTI
C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
C:\Windows\system32\Dwm.ex
C:\Windows\Explorer.EXE
C:\Windows\system32\WTable
C:\Windows\System32\mobsyn
C:\Program Files\Fujitsu\FUJ02E3\FUJ0
C:\Program Files\Fujitsu\SSUtility\FJ
C:\Program Files\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe
C:\Program Files\Fingerprint Sensor\ATSwpNav.exe
C:\Program Files\Softex\OmniPass\scur
C:\Windows\System32\hkcmd.
C:\Windows\System32\igfxpe
C:\Program Files\HEXelon MAX 6\hexelon.exe
C:\Program Files\Lexmark X5400 Series\lxdvmon.exe
C:\Windows\system32\igfxsr
C:\Program Files\Lexmark X5400 Series\lxdvamon.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\ClipMate7\ClipMate.e
C:\Program Files\Evernote\ritePen\Rit
C:\Program Files\TweakVI\TweakVI.exe
C:\Program Files\FireTrust\Benign\B9.
D:\Utilities\BatteryAlarm.
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\FireTrust\MailWasher
C:\Program Files\Fujitsu\Utils\FjDspM
C:\Program Files\Fujitsu\Utils\fjeven
C:\Program Files\Fujitsu\Utils\FjMenu
C:\Windows\system32\igfxex
C:\Program Files\Fujitsu\Utils\FjIrKb
c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe
C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonaliz
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\VCOM\PowerDesk\PDExp
C:\PROGRA~1\MICROS~2\OFFIC
C:\Program Files\Windows Media Player\wmplayer.exe
c:\Program Files\Toshiba\Bluetooth Toshiba Stack\tosOBEX.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtProc.exe
C:\Users\Nelson\Desktop\ht
R0 - HKCU\Software\Microsoft\In
R1 - HKLM\Software\Microsoft\In
R1 - HKLM\Software\Microsoft\In
R1 - HKLM\Software\Microsoft\In
R0 - HKLM\Software\Microsoft\In
O1 - Hosts: ::1 localhost
O1 - Hosts: 127.98.9.2 mail.thenelson.name.b9
O1 - Hosts: 127.98.9.1 mail.nosuffering.com.b9
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-7
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6
O2 - BHO: RoboForm - {724d43a9-0d85-11d4-9908-0
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-0
O4 - HKLM\..\Run: [LoadFUJ02E3] C:\Program Files\Fujitsu\FUJ02E3\FUJ0
O4 - HKLM\..\Run: [SSUtility] C:\Program Files\Fujitsu\SSUtility\FJ
O4 - HKLM\..\Run: [FjStrtAp] C:\Program Files\Fujitsu\Utils\FjStrt
O4 - HKLM\..\Run: [IndicatorUtility] C:\Program Files\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe
O4 - HKLM\..\Run: [ATSwpNav] "C:\Program Files\Fingerprint Sensor\ATSwpNav" -run
O4 - HKLM\..\Run: [OmniPass] C:\Program Files\Softex\OmniPass\scur
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpe
O4 - HKLM\..\Run: [HEXelon MAX] "C:\PROGRA~1\HEXELO~1\hexe
O4 - HKLM\..\Run: [lxdvmon.exe] "C:\Program Files\Lexmark X5400 Series\lxdvmon.exe"
O4 - HKLM\..\Run: [lxdvamon] "C:\Program Files\Lexmark X5400 Series\lxdvamon.exe"
O4 - HKLM\..\Run: [Lexmark X5400 Series Fax Server] "C:\Program Files\Lexmark X5400 Series\fm3032.exe" /s
O4 - HKLM\..\Run: [Intuit SyncManager] C:\Program Files\Common Files\Intuit\Sync\IntuitSy
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ClipMate7] C:\Program Files\ClipMate7\ClipMate.e
O4 - HKCU\..\Run: [ritePen] C:\Program Files\Evernote\ritePen\Rit
O4 - HKCU\..\Run: [TweakVI] "C:\Program Files\TweakVI\tweakvi.exe"
O4 - HKCU\..\Run: [b9] "C:\Program Files\FireTrust\Benign\B9.
O4 - Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync
O4 - Startup: BatteryAlarm.lnk = D:\Utilities\BatteryAlarm.
O4 - Startup: Bluetooth Manager.lnk = ?
O4 - Startup: MailWasherPro.lnk = C:\Program Files\FireTrust\MailWasher
O4 - Startup: Microsoft Office Outlook 2003.lnk = ?
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync
O4 - Global Startup: BatteryAlarm.lnk = D:\Utilities\BatteryAlarm.
O4 - Global Startup: Bluetooth Manager.lnk = ?
O4 - Global Startup: MailWasherPro.lnk = C:\Program Files\FireTrust\MailWasher
O4 - Global Startup: Microsoft Office Outlook 2003.lnk = ?
O8 - Extra context menu item: Add to Banner Ad Blocker - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2
O8 - Extra context menu item: Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillFo
O8 - Extra context menu item: RoboForm Toolbar - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowTo
O8 - Extra context menu item: Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePa
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-0
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-0
O9 - Extra button: Web traffic protection statistics - {1F460357-8A94-4D71-9CA3-A
O9 - Extra button: @C:\Windows\WindowsMobile\
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-0
O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C
O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C
O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C
O9 - Extra button: Customize - {320AF880-6646-11D3-ABEE-C
O9 - Extra 'Tools' menuitem: Customize Menu - {320AF880-6646-11D3-ABEE-C
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-0
O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-0
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3
O9 - Extra button: PDFill PDF Editor - {FB858B22-55E2-413f-87F5-3
O13 - Gopher Prefix:
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-4
O18 - Protocol: intu-help-qb2 - {84D77A00-41B5-4B8B-8ADF-8
O18 - Protocol: qbwc - {FC598A64-626C-4447-85B8-5
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPE
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsms
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
O23 - Service: lxdvCATSCustConnectService
O23 - Service: lxdv_device - - C:\Windows\system32\lxdvco
O23 - Service: O2Flash Memory Service (O2Flash) - O2Micro International - C:\Windows\system32\o2flas
O23 - Service: Softex OmniPass Service (omniserv) - Softex Inc. - C:\Program Files\Softex\OmniPass\Omni
O23 - Service: QBCFMonitorService - Intuit - C:\Program Files\Common Files\Intuit\QuickBooks\QB
O23 - Service: Intuit QuickBooks FCS (QBFCService) - Intuit Inc. - C:\Program Files\Common Files\Intuit\QuickBooks\FC
O23 - Service: TabletService - Wacom Technology, Corp. - C:\Windows\system32\Tablet
O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
O23 - Service: UpdateNaviInstallService - FUJITSU LIMITED - C:\Program Files\Fujitsu\fjdvrupd\upd
--
End of file - 11012 bytes
The Hijackthis log looks good, how's the Kaspersky scan, did it find any threats?
ASKER
Yes it did. According to its report, it found & blocked 15 adware and malware. A full scan took only 49 minutes. Avg took > 6 hours for a scan and found nothing. I'm impressed. I'm going to try the trial for a few weeks then probably buy it.
Thanks to everyone for your help.
Nelson
Thanks to everyone for your help.
Nelson
Kaspersky is great.... in detection and removal it's better than the others.
Thanks!
Thanks!
Down load Kaspersky Internet Security 2009 trial version and install it and scan your system. It will solve your problem. You can download from the below link.
http://www.kaspersky.com/trials
Thanks