Mind Taking a Look at my DXDiag/Hijack This?


Hawkeyed

 

Posted

Howdy Folks,

I'm experiencing a bit of choppy performance lately and figured I'd let some people far more knowledgeable than I take a peek and make sure things look kosher. Thanks in advance.

---System information gathered by CoH Helper version 0.1.1.7---

DxDiag gathered at July 21, 2009 07:38 (-04:00)
Operating System: Windows XP Professional (5.1, Build 2600) Service Pack 3 (2600.xpsp_sp3_gdr.090206-1234)
System Manufacturer: Dell Inc.
System Model: Dell XPS710
BIOS: Phoenix ROM BIOS PLUS Version 1.10 1.4.0
Central Processor: Intel(R) Core(TM)2 CPU 6600 @ 2.40GHz (2 CPUs)
Memory: 3070MB
.Net Memory Report: 2386MB out of 3069MB available
Page File: 5423MB (554MB currently in use)
C Drive: (ST3320620AS) 234487MB out of 300442MB (78%) free
D Drive: (PHILIPS DVD+-RW DVD8881) zero-size drive
Windows directory location: C:\WINDOWS
DirectX: DirectX 9.0c (4.09.0000.0904)
DirectX Diag version: 5.03.2600.5512 (32-bit version)

Display Notes: No problems found.
Sound Notes: No problems found.
Input Notes: No problems found.

Monitor: Plug and Play Monitor
Monitor's Max Resolution: 1600,1200
Video Device Name: NVIDIA GeForce GTX 260
Manufacturer / Chip: NVIDIA / GeForce GTX 260
Video Memory: 896.0 MB
Driver Version: 6.14.0011.7824
Driver Date: 11/4/2008 4:35:23 PM
Driver Language: English

Sound Device Description: SB X-Fi Audio [CCE0]
Driver File: ctaud2k.sys
Driver Version: 6.00.0001.1283
Driver Date: 2/25/2008 9:43:24 AM


WMI Information
Motherboard Manufacturer: Dell Inc.
Motherboard Model: (empty)
Motherboard Product: 0UY253
Motherboard Version: A00
BIOS Manufacturer: Dell Inc.
BIOS Name: Phoenix ROM BIOS PLUS Version 1.10 1.4.0
BIOS Version: DELL - 14
BIOS Release: 20070309000000.000000+000

Registry Information for Current User
Resolution: 1680x1050
3D Resolution: 1680x1050 (Not using renderscale)
Full Screen: Yes
Maximized: No
Screen Position: 0, 0
Refresh Rate: 60Hz
Vertical Sync Enabled: Yes

Physics Quality: Medium
Maximum Particles: 50000
Max Particle Fill? 10.000
Physics Card Enabled: No

Anti-aliasing: None
Anisotropic Filtering: 4x
Texture LOD Bias: Smooth
Water Effects: High Quality
Bloom: 1.000 (turned on)
Depth of Field Enabled: Yes
Desaturation Effects (Sepia) Enabled: Yes
Shader Detail: High

World Texture Level: Very High
Character Texture Level: Very High
World Detail Level (Vis_Scale): 1.000
Entity Detail Level: 1.000
Shadows Enabled: Yes
Gamma Correction: 1.000
Geometry Buffers (VBOs) Enabled: Yes
Suppression of Extra Player FX Enabled: No
Suppression of FX When Camera Close Enabled: Yes
Close Suppression Range: 3.000
Show Advertisements: Yes

Audio Mode: Performance
3D Audio: No
FX Sound Volume: 0.151
Music Sound Volume: 0.151

Show Advanced Graphics Options: Yes
Overall Graphics Quality: 0.600
Reverse Mouse Buttons: No
Save Login Username: Yes
Transfer Rate: 963590 bytes/second
Current Game Version: 19.20090702.5T2
Installation Directory: C:\Program Files\City of Heroes

Mod files in the Data directory
.\texture_library\GUI\Icons\Powers has 120 files
.\texture_library\MAPS\city has 1 file
.\texture_library\MAPS\Safeguard has 9 files
.\texture_library\MAPS\sewers has 44 files
.\texture_library\MAPS\static has 34 files
.\texture_library\V_MAPS\Outdoor_Missions has 9 files
.\texture_library\V_MAPS\Static has 16 files


It's a dog's life/In a rope leash or a diamond collar...

 

Posted

And the Hijack This...

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 7:25:19 AM, on 7/21/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Creative\Shared Files\CTAudSvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\SYSTEM32\CTXFISPI.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\PROGRA~1\AVG\AVG8\avgfws8.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\PROGRA~1\AVG\AVG8\avgam.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Linksys\WMP300N\WLService.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\Linksys\WMP300N\WMP300N.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Larson\Desktop\HiJackThis_v2.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=4070515
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/...ch/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/.../www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/...ch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=4070515
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/.../www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Comcast
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = *.local
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O3 - Toolbar: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - (no file)
O4 - HKLM\..\Run: [AudioDrvEmulator] "C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" -1 AudioDrvEmulator "C:\Program Files\Creative\Shared Files\Module Loader\Audio Emulator\AudDrvEm.dll"
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Installer] C:\Documents and Settings\Larson\Desktop\setup_241_3777_.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: AVG8 Firewall (avgfws8) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgfws8.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTAudSvc.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE
O23 - Service: WMP300NSvc - GEMTEKS - C:\Program Files\Linksys\WMP300N\WLService.exe

--
End of file - 7624 bytes


It's a dog's life/In a rope leash or a diamond collar...

 

Posted

I can't see any problems in your COH Helper report, although updating your drivers might be good.

But in your HiJackThis, it seems to me you have a problem:

[ QUOTE ]

O4 - HKCU\..\Run: [Installer] C:\Documents and Settings\Larson\Desktop\setup_241_3777_.exe


[/ QUOTE ]

I'm sorry, I can't tell you the best way to solve it, but if you google it you might find a solution.


 

Posted

I agree.

Google that exe that's currently running and kill it if need to.

Don't be certain it's nothing bad, granted both AVG and Spybot are good, they "can" miss things.

A few questions:

Anything running on your other computers on your network? Downloading things, etc..

Your wireless card could be getting a weak strength. Are you moving around or always playing in the same spot?


Good luck!





Hawkeyed


@Hawkeyed
P.E.R.C. Senior Pinnacle Rep


[url="http://www.guildportal.com/Guild.aspx?GuildID=217406&TabID=1833355"]PERC Site[/url]


"Nothing grabs your attention like a pink fluffy bunny with imps dancing around it" -Kranny

 

Posted

[ QUOTE ]
I can't see any problems in your COH Helper report, although updating your drivers might be good.

But in your HiJackThis, it seems to me you have a problem:

[ QUOTE ]

O4 - HKCU\..\Run: [Installer] C:\Documents and Settings\Larson\Desktop\setup_241_3777_.exe


[/ QUOTE ]

I'm sorry, I can't tell you the best way to solve it, but if you google it you might find a solution.

[/ QUOTE ]

I believe this is either ProAntiSpyware 2009 or one of the many variants of this malware/scareware program.

Download Malwarebytes Anti-Malware, install it, update it, and run a scan with it. Let it remove any infections it finds.


If the game spit out 20 dollar bills people would complain that they weren't sequentially numbered. If they were sequentially numbered people would complain that they weren't random enough.

Black Pebble is my new hero.

 

Posted

I googled that exe, and you've got a nice little piece of spyware on your PC.

It visits sites without your knowing, causing the lag your getting.

If you google it, you'll get solutions like I got and ways to kill it.

Again, nice nasty little bug you got.

Good luck removing it. Hope all gets fixed.




Hawkeyed


@Hawkeyed
P.E.R.C. Senior Pinnacle Rep


[url="http://www.guildportal.com/Guild.aspx?GuildID=217406&TabID=1833355"]PERC Site[/url]


"Nothing grabs your attention like a pink fluffy bunny with imps dancing around it" -Kranny

 

Posted

<QR>

SETUP_241_3777_[n].EXE

The filename is associated with the malware groups:
* Worm
* System Back Door
* Cloaked Malware

SETUP_241_3777_[n].EXE has been seen to perform the following behavior:
* The Process is packed and/or encrypted using a software packing process
* Creates system tray popups, messages, errors and security warnings
* Visits web sites on your PC without you knowing
* Executes a Process
* Adds products to the system registry
* Adds a Registry Key (RUN) to auto start Programs on system start up
* Can communicate with other computer systems using HTTP protocols
* This Process Deletes Other Processes From Disk
* This process creates other processes on disk
* Executes Processes stored in Temporary Folders
* Found on infected systems and resists interrogation by security products

SETUP_241_3777_[n].EXE has been the subject of the following behavior:
* Created as a process on disk
* Deleted as a process from disk
* Added as a Registry auto start to load Program on Boot up
* Executed as a Process
* Executed by Internet Explorer
* Terminated as a Process
* Has code inserted into its Virtual Memory space by other programs

One or more files with the name SETUP_241_3777_[n].EXE
* Opens/modifes c:\autoexec.bat

One or more files with the name SETUP_241_3777_[n].EXE interacts with the following web sites and pages. (Web addresses have been deliberately modified to prevent unintentional use.)
* int .vbvyu .com / stat .php?func=installrun&id=0&landing=-1〈=EN⊂=0
* Port 80 IP:193.142.244.203


I suspect that program is sitting in the background using up your system resources and causing CoH to run horribly.


 

Posted

Thanks for all the replies, and thanks for catching that virus. I googled it and managed to eliminate it. I'll update the drivers later today as well. So far, seems to be running smoother. Thanks again,

Helix


It's a dog's life/In a rope leash or a diamond collar...

 

Posted

Here's the updated Hijack This log if you wouldn't mind double-checking for me.

Helix

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 2:40:52 PM, on 7/21/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Creative\Shared Files\CTAudSvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\SYSTEM32\CTXFISPI.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\PROGRA~1\AVG\AVG8\avgfws8.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\PROGRA~1\AVG\AVG8\avgam.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Linksys\WMP300N\WLService.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\Linksys\WMP300N\WMP300N.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Larson\Desktop\HiJackThis_v2.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=4070515
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/...ch/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/.../www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/...ch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=4070515
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/.../www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Comcast
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = *.local
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O3 - Toolbar: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - (no file)
O4 - HKLM\..\Run: [AudioDrvEmulator] "C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" -1 AudioDrvEmulator "C:\Program Files\Creative\Shared Files\Module Loader\Audio Emulator\AudDrvEm.dll"
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: AVG8 Firewall (avgfws8) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgfws8.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTAudSvc.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE
O23 - Service: WMP300NSvc - GEMTEKS - C:\Program Files\Linksys\WMP300N\WLService.exe

--
End of file - 7578 bytes


It's a dog's life/In a rope leash or a diamond collar...

 

Posted

Looks clean.

Glad to hear you got the little bugger removed. I find spyware hard to remove then a virus, since well yeah, it spreads quicker imho.






Hawk


@Hawkeyed
P.E.R.C. Senior Pinnacle Rep


[url="http://www.guildportal.com/Guild.aspx?GuildID=217406&TabID=1833355"]PERC Site[/url]


"Nothing grabs your attention like a pink fluffy bunny with imps dancing around it" -Kranny