Thanks a lot for the quick response
This computer used to be my cousin's, she used BearShare quite a lot. As soon as the computer was given to me, I uninstalled the program. I checked Add/Remove program and it wasn't there. Is it still on my computer?
-----------------------------------------------------------------------
Here's my MBAM log:
Malwarebytes' Anti-Malware 1.28
Database version: 1136
Windows 5.1.2600 Service Pack 3
10/09/2008 15:38:23
mbam-log-2008-09-10 (15-38-23).txt
Scan type: Full Scan (C:\|)
Objects scanned: 104158
Time elapsed: 2 hour(s), 20 minute(s), 36 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 7
Registry Values Infected: 3
Registry Data Items Infected: 0
Folders Infected: 5
Files Infected: 4
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
HKEY_CLASSES_ROOT\loaderx.installer (Adware.Winad) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\loaderx.installer.1 (Adware.Winad) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{1e5e0d38-214b-4085-ad2a-d2290e6a2d2c} (Adware.Winad) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\MediaHoldings (Adware.PlayMP3Z) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\dslcnnct (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Media Pass (Adware.Winad) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Uninstall\Media Pass (Adware.Winad) -> Quarantined and deleted successfully.
Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Products\rdomain (Rogue.PCVirusless) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Products\prodname (Rogue.PCVirusless) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Products\compname (Rogue.PCVirusless) -> Quarantined and deleted successfully.
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
C:\Program Files\MyGlobalSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyGlobalSearch\bar (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\Windows AdStatus (Adware.AdStatus) -> Quarantined and deleted successfully.
C:\AntiSpywareSuite (Rogue.AntiSpywareSuite) -> Quarantined and deleted successfully.
C:\AntiSpywareSuite\AVQuar (Rogue.AntiSpywareSuite) -> Quarantined and deleted successfully.
Files Infected:
C:\WINDOWS\system32\mcrh.tmp (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\pskt.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\BM846617e1.xml (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\BM846617e1.txt (Trojan.Vundo) -> Quarantined and deleted successfully.
-----------------------------------------------------------------------
Here's my Hijack This Log:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:39:51, on 10/09/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\UAService7.exe
C:\Program
Files\Viewpoint\Common\ViewpointService.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Microsoft IntelliType
Pro\type32.exe
C:\Program Files\Viewpoint\Viewpoint
Manager\ViewMgr.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIA ME
.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\HP Wireless Keyboard\KMaestro.exe
C:\PROGRA~1\VISION~1\ONETOU~2.EXE
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Belkin\USB F5D7050\Wireless
Utility\Belkinwcui.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Trend
Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft
Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\NOTEPAD.EXE
R1 - HKCU\Software\Microsoft\Internet
Explorer\Main,SearchAssistant =
Search
R0 - HKCU\Software\Microsoft\Internet
Explorer\Main,Start Page =
iGoogle
ce=iglk
R1 - HKLM\Software\Microsoft\Internet
Explorer\Main,Default_Page_URL =
MSN.com
R1 - HKLM\Software\Microsoft\Internet
Explorer\Main,Default_Search_URL =
Live Search
R1 - HKLM\Software\Microsoft\Internet
Explorer\Main,SearchAssistant = about
:blank
R1 - HKLM\Software\Microsoft\Internet
Explorer\Main,Search Page =
Live Search
R0 - HKLM\Software\Microsoft\Internet
Explorer\Main,Start Page =
MSN.com
R0 - HKLM\Software\Microsoft\Internet
Explorer\Search,CustomizeSearch =
R1 -
HKCU\Software\Microsoft\Windows\CurrentVersion\Int er
net Settings,ProxyOverride = localhost
R3 - URLSearchHook: Yahoo! Toolbar -
{EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: IE7Pro -
{00011268-E188-40DF-A514-835FCD78B1BF} - C:\Program
Files\IEPro\iepro.dll
O2 - BHO: Adobe PDF Reader Link Helper -
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program
Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
(file missing)
O2 - BHO: (no name) -
{10532A8D-0BA9-4395-BE82-42ECD8918B8F} - (no file)
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter -
{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program
Files\AVG\AVG8\avgssie.dll
O2 - BHO: (no name) -
{552F9347-F813-422D-BF2D-0F3B76E65FCC} - (no file)
O2 - BHO: (no name) -
{638285EB-2711-4B37-9A2B-789F0EDB8E1D} - (no file)
O2 - BHO: (no name) -
{719CC264-1638-4E71-BA48-580EDCB73803} - (no file)
O2 - BHO: (no name) -
{7464CBBC-9458-4E6C-B1EE-B05728E7F340} - (no file)
O2 - BHO: SSVHelper Class -
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program
Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) -
{7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) -
{884FCB7B-67EF-4771-AE57-10C7F89822A4} - (no file)
O2 - BHO: Windows Live Sign-in Helper -
{9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program
Files\Common Files\Microsoft Shared\Windows
Live\WindowsLiveLogin.dll
O2 - BHO: (no name) -
{CC59E0F9-7E43-44FA-9FAA-8377850BF205} - (no file)
O2 - BHO: EpsonToolBandKicker Class -
{E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program
Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page -
{EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program
Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE
C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE
C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics]
"C:\Program Files\Thomson\SpeedTouch
USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [type32] "C:\Program
Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [EPSON Stylus Photo RX640 Series]
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIA ME
.EXE /P31 "EPSON Stylus Photo RX640 Series" /O6
"USB001" /M "Stylus Photo RX640"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [BtcMaestro] "C:\Program Files\HP
Wireless Keyboard\KMaestro.exe"
O4 - HKLM\..\Run: [OneTouch Monitor]
C:\PROGRA~1\VISION~1\ONETOU~2.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program
Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AVG8_TRAY]
C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [CTFMON.EXE]
C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program
Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [J0s7Rhd8X] mmufr.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE]
C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL
SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE]
C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK
SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE]
C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE]
C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Check for OneTouch Updates.lnk =
C:\Program Files\Visioneer OneTouch\WiseUpdt.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk =
C:\Program Files\Adobe\Acrobat
7.0\Reader\reader_sl.exe
O4 - Global Startup: Belkin Wireless USB Utility.lnk
= C:\Program Files\Belkin\USB F5D7050\Wireless
Utility\Belkinwcui.exe
O9 - Extra button: IE7Pro Preferences -
{0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program
Files\IEPro\iepro.dll
O9 - Extra 'Tools' menuitem: IE7Pro Preferences -
{0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program
Files\IEPro\iepro.dll
O9 - Extra button: (no name) -
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program
Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console -
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program
Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Research -
{92780B25-18CC-41C8-B9BE-3C9C571A8263} -
C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) -
{e2e2dd38-d088-4134-82b7-f2ba38496583} -
C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 -
{e2e2dd38-d088-4134-82b7-f2ba38496583} -
C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger -
{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program
Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger -
{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program
Files\Messenger\msmsgs.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C}
(Checkers Class) -
http://messenger.zone.msn.com/binary/msgrchkr.cab312
67.cab
O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3}
(StagingUI Object) -
http://zone.msn.com/binFrameWork/v10/StagingUI.cab55
579.cab
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E}
(Musicnotes Viewer) -
http://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700}
(Windows Genuine Advantage Validation Tool) -
http://go.microsoft.com/fwlink/?linkid=34738&clcid=0
x409
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501}
(Checkers Class) -
http://messenger.zone.msn.com/binary/msgrchkr.cab569
86.cab
O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8}
(MSN Games – Buddy Invite) -
http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab55579
.cab
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134}
(MySpace Uploader Control) -
http://lads.myspace.com/upload/MySpaceUploader1006.c
ab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537}
(MSN Photo Upload Tool) -
http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.c
ab
O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3}
(ZonePAChat Object) -
http://zone.msn.com/binframework/v10/ZPAChat.cab5557
9.cab
O16 - DPF: {5D80A6D1-B500-47DA-82B8-EB9875F85B4D}
(Google Gadget Control) -
http://dl.google.com/dl/desktop/nv/GoogleGadgetPlugi
nIEWin.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166}
(Windows Live Safety Center Base Module) -
Windows Live OneCare
canner/wlscbase5036.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} -
DivX Video Player - DivX Codec - DivX Converter - DivX Web Player - Download DivX for Windows
b
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D}
(MessengerStatsClient Class) -
http://messenger.zone.msn.com/binary/MessengerStatsC
lient.cab31267.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592}
(MSN Games - Installer) -
http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab
56649.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} -
http://us.dl1.yimg.com/download.yahoo.com/dl/install
s/suite/autocomplete.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072}
(MessengerStatsClient Class) -
http://messenger.zone.msn.com/binary/MessengerStatsP
AClient.cab56907.cab
O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937}
(MSN Games – Game Communicator) -
http://zone.msn.com/binframework/v10/StProxy.cab5557
9.cab
O16 - DPF: {F09BFD07-20B5-46D8-A6D5-BE4EF22F1F4D}
(DGTx.uc1) -
http://69.57.132.82/DGTx.CAB
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48}
(Minesweeper Flags Class) -
http://messenger.zone.msn.com/binary/MineSweeper.cab
56986.cab
O16 - DPF: {FF3C5A9F-5A99-4930-80E8-4709194C2AD3}
(MSN Games – Backgammon) -
MSN Games - Free Online Games.
cab64162.cab
O18 - Protocol: linkscanner -
{F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program
Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program
Files\SUPERAntiSpyware\SASWINLO.DLL
O20 - Winlogon Notify: cbXPgfff - cbXPgfff.dll (file
missing)
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG
Technologies CZ, s.r.o. -
C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG
Technologies CZ, s.r.o. -
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: InstallDriver Table Manager
(IDriverT) - Macrovision Corporation - C:\Program
Files\Common Files\InstallShield\Driver\11\Intel
32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc)
- NVIDIA Corporation -
C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SoundMAX Agent Service (SoundMAX
Agent Service (default)) - Analog Devices, Inc. -
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: SecuROM User Access Service (V7)
(UserAccess7) - Sony DADC Austria AG. -
C:\WINDOWS\system32\UAService7.exe
O23 - Service: Viewpoint Manager Service - Viewpoint
Corporation - C:\Program
Files\Viewpoint\Common\ViewpointService.exe
--
End of file - 11093 bytes
-----------------------------------------------------------------------
And here's my Add/Remove Programs list from Hijack This:
7-Zip 4.57
Adobe Acrobat 5.0
Adobe Flash Player ActiveX
Adobe Reader 7.1.0
Adobe Shockwave Player 11
Audacity 1.2.6
AudibleManager
Autograph 3.02
AVG Free 8.0
AVS Video Converter 5.6
Belarc Advisor 7.2
Belkin Wireless USB Utility
Blaze Media Pro
CCleaner (remove only)
COWON Media Center - jetAudio Basic
D-Link VGA Webcam
EPSON Copy Utility 3
EPSON Easy Photo Print
EPSON Event Manager
EPSON Image Clip Palette
EPSON PRINT Image Framer Tool
EPSON Printer Software
EPSON Scan
EPSON Scan Assistant
EPSON Web-To-Page
ESPRX640 User's Guide
Express Burn
Express Dictate
FinePix Studio
FinePixViewer Resource
FinePixViewer Ver.5.4
FUJIFILM USB Driver
Google Earth
Graboid Video 1.2
HighMAT Extension to Microsoft Windows XP CD Writing
Wizard
HijackThis 2.0.2
Hotfix for Windows Internet Explorer 7 (KB947864)
HP Customer Participation Program 7.0
hp deskjet 3820 series (Remove only)
HP Imaging Device Functions 7.0
HP Photosmart and Deskjet 7.0 Software
HP Photosmart Essential
HP Solution Center 7.0
HP Update
IE7Pro
InCD (ahead software)
Java(TM) 6 Update 4
Java(TM) 6 Update 5
Last.fm 1.5.1.29527
LimeWire 4.18.3
Macromedia Shockwave Player
Malwarebytes' Anti-Malware
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 2.0 Service Pack 1
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation
APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office 2000 Premium
Microsoft Office Professional Edition 2003
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft User-Mode Driver Framework Feature Pack
1.0
Microsoft Visual C++ 2005 Redistributable
Microsoft Windows Journal Viewer
MixPad
Motherboard Monitor 5
Mozilla ActiveX Control v1.7.12
Mp3tag v2.41
MSXML 4.0 SP2 (KB925672)
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
NVIDIA Drivers
OneTouch Version 3.0
Paint Shop Pro 5.01
QuickTime
Realtek AC'97 Audio
Search Relevancy
Security Update for Windows Internet Explorer 7
(KB928090)
Security Update for Windows Internet Explorer 7
(KB929969)
Security Update for Windows Internet Explorer 7
(KB931768)
Security Update for Windows Internet Explorer 7
(KB933566)
Security Update for Windows Internet Explorer 7
(KB937143)
Security Update for Windows Internet Explorer 7
(KB938127)
Security Update for Windows Internet Explorer 7
(KB939653)
Security Update for Windows Internet Explorer 7
(KB942615)
Security Update for Windows Internet Explorer 7
(KB944533)
Security Update for Windows Internet Explorer 7
(KB950759)
Security Update for Windows Internet Explorer 7
(KB953838)
Security Update for Windows Media Player 11
(KB954154)
Security Update for Windows XP (KB938464)
Shockwave
Shop for HP Supplies
Sony Ericsson PC Suite
Sony Picture Utility
Sony USB Driver
SoundMAX
SpeedTouch USB Software
Spybot - Search & Destroy 1.4
SUPERAntiSpyware Free Edition
Switch
USB MassStorage CardReader
VIA Integrated Setup Wizard
VIA Rhine-Family Fast-Ethernet Adapter
Viewpoint Manager (Remove Only)
Viewpoint Media Player
Viewpoint Toolbar
Windows Imaging Component
Windows Live installer
Windows Live Messenger
Windows Live OneCare safety scanner
Windows Live Sign-in Assistant
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 11
Windows Media Player 11
Windows XP Service Pack 3
