Pyagcore.detection

GraceLeah · June 27, 2009

Hi Guys

I desperately need help. I, very stupidly, downloaded the Kiweg toolbar and, as you may have guessed, have got big problems. I found your website on Google and am following your instructions. I've downloaded HijackThis and here is the report from it. Please help.

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 11:28:18, on 27/06/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Windows Defender\MsMpEng.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Google\Update\GoogleUpdate.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\ESET\ESET Smart Security\egui.exe

C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe

C:\Program Files\Microsoft IntelliType Pro\itype.exe

C:\Program Files\Microsoft IntelliPoint\ipoint.exe

C:\WINDOWS\RTHDCPL.EXE

C:\WINDOWS\system32\igfxtray.exe

c:\Program Files\Microsoft IntelliType Pro\dpupdchk.exe

C:\WINDOWS\system32\hkcmd.exe

C:\WINDOWS\system32\igfxpers.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\Program Files\ESET\ESET Smart Security\ekrn.exe

C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Program Files\uTorrent\uTorrent.exe

C:\Program Files\Messenger\msmsgs.exe

C:\Program Files\Windows Desktop Search\WindowsSearch.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Common Files\Motive\McciCMService.exe

C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

C:\WINDOWS\System32\TUProgSt.exe

C:\Program Files\Kiwee Toolbar\2.9.201\kwtbaim.exe

C:\WINDOWS\system32\SearchIndexer.exe

C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe

C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe

C:\Program Files\Windows Defender\MSASCui.exe

C:\Program Files\ParetoLogic\Anti-Spyware\Pareto_AS.exe

C:\Program Files\Uniblue\PowerSuite\PowerSuite.exe

C:\Program Files\Uniblue\SpyEraser\SpyEraser.exe

C:\Program Files\Windows Live\Family Safety\fsui.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\PROGRA~1\Yahoo!\browser\ycommon.exe

C:\Program Files\Windows Live\Toolbar\wltuser.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Documents and Settings\Anyone\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Symbaloo - start simple

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Yahoo!

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Yahoo! Search - Web Search

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = Yahoo! SearchBar Home Page

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Symbaloo - start simple

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = Symbaloo - start simple

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = Yahoo! Search - Web Search

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

R3 - Default URLSearchHook is missing

O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll

O2 - BHO: Kiwee Toolbar - {6638A9DE-0745-4292-8A2E-AE530E7B9B3F} - C:\Program Files\Kiwee Toolbar\2.9.201\KiweeIEToolbar.dll

O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.15642\swg.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll

O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll

O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll

O3 - Toolbar: Kiwee Toolbar - {6638A9DE-0745-4292-8A2E-AE530E7B9B3F} - C:\Program Files\Kiwee Toolbar\2.9.201\KiweeIEToolbar.dll

O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice

O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

O4 - HKLM\..\Run: [iSUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup

O4 - HKLM\..\Run: [iSUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start

O4 - HKLM\..\Run: [EasyTuneVPro] C:\Program Files\Gigabyte\ET5Pro\ETcall.exe

O4 - HKLM\..\Run: [itype] "c:\Program Files\Microsoft IntelliType Pro\itype.exe"

O4 - HKLM\..\Run: [intelliPoint] "c:\Program Files\Microsoft IntelliPoint\ipoint.exe"

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKCU\..\Run: [EPSON Stylus D92 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBZE.EXE /FU "C:\WINDOWS\TEMP\E_S6AC.tmp" /EF "HKCU"

O4 - HKCU\..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe"

O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [Pareto_Update] C:\Program Files\Common Files\ParetoLogic\UUS2\Pareto_Update.exe

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra button: BT Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab

O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll

O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase1140.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1237217742385

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - http://www.gamehouse.com/realarcade-webgames/astropop/popcaploader.cab

O21 - SSODL: MSVDTDDGridCtrl7Object - {95d5c19d-f553-4c3d-8c51-f9f12cf376a1} - C:\Program Files\Common Files\MSVDTDDGridCtrl7\MSVDTDDGridCtrl7Object.dll

O23 - Service: AG Windows Service (AGWinService) - Unknown owner - C:\Program Files\AGI\common\win32\PythonService.exe

O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe

O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe

O23 - Service: Google Update Service (gupdate1c9bc7fb18dd2a0) (gupdate1c9bc7fb18dd2a0) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: McciCMService - Motive Communications, Inc. - C:\Program Files\Common Files\Motive\McciCMService.exe

O23 - Service: McAfee Real-time Scanner (McShield) - Unknown owner - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe (file missing)

O23 - Service: McAfee SystemGuards (McSysmon) - Unknown owner - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe (file missing)

O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe

O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe

O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software - C:\WINDOWS\System32\TuneUpDefragService.exe

O23 - Service: TuneUp Program Statistics Service (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\WINDOWS\System32\TUProgSt.exe

--

End of file - 11628 bytes

GraceLeah · June 27, 2009

The problem is still there

Hi Guys,

It's me again. I have followed your steps to the letter and the problem is still there. What can I do now?

Malwarebytes' Anti-Malware 1.38

Database version: 2341

Windows 5.1.2600 Service Pack 3

27/06/2009 12:45:21

mbam-log-2009-06-27 (12-45-21).txt

Scan type: Full Scan (C:\|F:\|)

Objects scanned: 176458

Time elapsed: 34 minute(s), 9 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 3

Registry Values Infected: 1

Registry Data Items Infected: 0

Folders Infected: 1

Files Infected: 1

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_CLASSES_ROOT\CLSID\{95d5c19d-f553-4c3d-8c51-f9f12cf376a1} (Trojan.FakeAlert.H) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\urlsearchhook.toolbarurlsearchhook (Trojan.BHO) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\urlsearchhook.toolbarurlsearchhook.1 (Trojan.BHO) -> Quarantined and deleted successfully.

Registry Values Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\msvdtddgridctrl7object (Trojan.FakeAlert.H) -> Quarantined and deleted successfully.

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

C:\Program Files\WinZix (Trojan.Lop) -> Quarantined and deleted successfully.

Files Infected:

C:\Program Files\Common Files\MSVDTDDGridCtrl7\MSVDTDDGridCtrl7Object.dll (Trojan.FakeAlert.H) -> Delete on reboot.

ComboFix 09-06-26.02 - Anyone 27/06/2009 13:24.2 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.3.1252.44.1033.18.2039.1343 [GMT 1:00]

Running from: c:\documents and settings\Anyone\Desktop\ComboFix.exe

AV: ESET Smart Security 3.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

FW: ESET Personal firewall *enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}

.

((((((((((((((((((((((((( Files Created from 2009-05-27 to 2009-06-27 )))))))))))))))))))))))))))))))

.

2009-06-27 11:06 . 2009-06-27 11:06 -------- d-----w- c:\documents and settings\Anyone\Application Data\Malwarebytes

2009-06-27 11:06 . 2009-06-17 10:27 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2009-06-27 11:05 . 2009-06-27 11:05 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2009-06-27 11:05 . 2009-06-17 10:27 19096 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-06-27 11:05 . 2009-06-27 11:06 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2009-06-26 18:44 . 2009-06-26 18:44 603904 ----a-w- c:\windows\system32\TUProgSt.exe

2009-06-26 18:44 . 2008-11-12 15:44 27904 ----a-w- c:\windows\system32\uxtuneup.dll

2009-06-26 18:44 . 2009-06-26 18:44 362240 ----a-w- c:\windows\system32\TuneUpDefragService.exe

2009-06-26 17:56 . 2009-06-26 17:56 -------- d-----w- c:\windows\system32\wbem\Repository

2009-06-26 17:52 . 2009-06-26 17:52 -------- d-----w- c:\documents and settings\All Users\Application Data\Kiwee Toolbar

2009-06-26 17:52 . 2009-06-26 17:52 -------- d-----w- c:\program files\Kiwee Toolbar

2009-06-26 17:52 . 2009-06-26 17:52 -------- d-----w- c:\documents and settings\All Users\Application Data\AGI

2009-06-25 23:36 . 2009-06-26 17:51 -------- d-----w- C:\HALLMARK

2009-06-24 21:49 . 2009-06-26 17:52 -------- d-----w- c:\documents and settings\All Users\Application Data\AGI(2)

2009-06-21 17:56 . 2009-06-21 17:56 -------- d-----w- c:\documents and settings\Anyone\Local Settings\Application Data\Kiwee Toolbar

2009-06-21 17:56 . 2009-06-21 17:56 -------- d-----w- c:\documents and settings\LocalService\Application Data\agi

2009-06-21 17:55 . 2009-06-24 21:49 -------- d-----w- c:\documents and settings\Anyone\Application Data\agi

2009-06-21 17:54 . 2009-06-21 17:54 339968 ----a-w- c:\windows\system32\pythoncom25.dll

2009-06-21 17:54 . 2009-06-21 17:54 2117632 ----a-w- c:\windows\system32\python25.dll

2009-06-21 17:54 . 2009-06-21 17:54 114688 ----a-w- c:\windows\system32\pywintypes25.dll

2009-06-21 17:53 . 2008-09-16 16:26 1332197 ----a-w- c:\windows\system32\pythondll.zip

2009-06-21 17:52 . 2009-06-24 21:49 -------- d-----w- c:\program files\AGI

2009-06-19 17:57 . 2009-06-19 17:57 -------- d-----w- c:\program files\Bricks Of Atlantis

2009-06-19 17:55 . 2009-06-19 17:55 -------- d-----w- c:\program files\Bricks Of Egypt

2009-06-19 17:51 . 2009-06-19 17:53 -------- d-----w- c:\program files\Bricks Of Egypt 2

2009-06-19 17:39 . 2009-06-19 17:40 -------- d-----w- c:\program files\Bricks Of Camelot

2009-06-17 18:13 . 2009-06-17 18:16 -------- d-----w- c:\program files\RegCure

2009-06-17 14:05 . 2009-06-17 15:36 -------- d-----w- c:\documents and settings\All Users\Application Data\SpeedBit

2009-06-17 11:37 . 2009-06-17 11:37 -------- d-----w- c:\documents and settings\All Users\Application Data\Awem

2009-06-17 11:37 . 2009-06-17 11:37 -------- d-----w- c:\program files\Games

2009-06-17 09:18 . 2007-03-18 20:37 65602 ----a-w- c:\windows\system32\cook3260.dll

2009-06-17 09:18 . 2006-09-29 12:26 176165 ----a-w- c:\windows\system32\drv23260.dll

2009-06-17 09:18 . 2006-09-29 12:25 208935 ----a-w- c:\windows\system32\drv33260.dll

2009-06-17 09:18 . 2006-09-29 12:24 217127 ----a-w- c:\windows\system32\drv43260.dll

2009-06-17 09:18 . 2006-05-20 16:16 1184984 ----a-w- c:\windows\system32\wvc1dmod.dll

2009-06-17 09:18 . 2006-05-11 19:21 626688 ----a-w- c:\windows\system32\vp7vfw.dll

2009-06-17 09:18 . 2002-12-10 02:20 102439 ----a-w- c:\windows\system32\sipr3260.dll

2009-06-13 22:37 . 2009-06-13 22:37 -------- d-----w- c:\program files\bfgclient

2009-06-13 22:30 . 2009-06-27 11:46 -------- d-----w- c:\program files\Common Files\MSVDTDDGridCtrl7

2009-06-13 22:30 . 2009-06-13 22:38 -------- d-----w- c:\documents and settings\All Users\Application Data\BigFishGamesCache

2009-06-13 22:09 . 2009-06-20 17:59 -------- d-----w- c:\program files\Disney Interactive

2009-06-13 21:37 . 2009-06-13 21:59 -------- d-----w- C:\Print & Interactive Studios

2009-06-11 09:56 . 2009-06-25 10:55 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP

2009-06-11 09:52 . 2009-06-11 09:52 -------- d-----w- c:\documents and settings\All Users\Application Data\Simply Super Software

2009-06-11 03:12 . 2009-04-30 21:22 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll

2009-06-11 03:12 . 2009-04-30 21:22 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll

2009-06-10 11:06 . 1996-01-09 00:34 246784 ----a-w- c:\windows\UNINST16.EXE

2009-06-10 11:06 . 2009-06-10 11:06 -------- d-----w- c:\documents and settings\Anyone\WINDOWS

2009-06-10 10:28 . 2009-06-10 10:28 721904 ----a-w- c:\windows\system32\drivers\sptd.sys

2009-06-09 19:08 . 2009-06-09 19:08 152576 ----a-w- c:\documents and settings\Anyone\Application Data\Sun\Java\jre1.6.0_14\lzma.dll

2009-06-02 22:39 . 2009-06-02 22:39 -------- d-----w- c:\program files\ReflexiveArcade

2009-06-01 11:11 . 2005-11-28 05:51 135168 ----a-r- c:\windows\system32\igfxres.dll

2009-05-30 13:11 . 2009-05-30 13:11 552 ----a-w- c:\windows\system32\d3d8caps.dat

2009-05-30 12:37 . 2008-02-11 10:55 147456 ----a-w- c:\windows\system32\igfxCoIn_v1437.dll

2009-05-30 12:37 . 2008-02-11 10:36 2302976 ----a-w- c:\windows\system32\drivers\igdkmd32.sys

2009-05-30 12:37 . 2008-02-11 10:36 3301376 ----a-w- c:\windows\system32\igdumd32.dll

2009-05-30 12:37 . 2008-02-11 10:01 2174976 ----a-w- c:\windows\system32\ig4dev32.dll

2009-05-30 12:37 . 2008-02-11 10:01 2420736 ----a-w- c:\windows\system32\ig4icd32.dll

2009-05-30 12:37 . 2008-02-11 09:48 245760 ----a-w- c:\windows\system32\igfxTMM.dll

2009-05-30 12:37 . 2008-02-11 09:47 69632 ----a-w- c:\windows\system32\oemdspif.dll

2009-05-29 20:19 . 2009-05-29 20:19 -------- d-----w- c:\program files\GameHouse

2009-05-29 10:40 . 2009-05-29 10:40 -------- d-----w- c:\program files\LG Software Innovations

2009-05-29 10:40 . 2009-05-29 10:40 -------- d-----w- c:\program files\Google Earth Pro 4.2

2009-05-29 10:39 . 2009-05-29 10:39 -------- d-----w- c:\program files\dvd43

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report )Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 13:33:53, on 27/06/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Windows Defender\MsMpEng.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\ESET\ESET Smart Security\ekrn.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Common Files\Motive\McciCMService.exe

C:\Program Files\Google\Update\GoogleUpdate.exe

C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

C:\WINDOWS\System32\TUProgSt.exe

C:\WINDOWS\system32\SearchIndexer.exe

C:\Program Files\ESET\ESET Smart Security\egui.exe

C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe

C:\Program Files\Microsoft IntelliType Pro\itype.exe

C:\Program Files\Microsoft IntelliPoint\ipoint.exe

C:\WINDOWS\RTHDCPL.EXE

C:\WINDOWS\system32\igfxtray.exe

C:\WINDOWS\system32\hkcmd.exe

C:\WINDOWS\system32\igfxpers.exe

C:\Program Files\Java\jre6\bin\jusched.exe

c:\Program Files\Microsoft IntelliType Pro\dpupdchk.exe

C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe

C:\Program Files\Windows Desktop Search\WindowsSearch.exe

C:\Program Files\Kiwee Toolbar\2.9.201\kwtbaim.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\Program Files\Windows Live\Toolbar\wltuser.exe

C:\WINDOWS\explorer.exe

C:\WINDOWS\system32\notepad.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

C:\Program Files\internet explorer\iexplore.exe

C:\PROGRA~1\Yahoo!\browser\ycommon.exe

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\Documents and Settings\Anyone\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Symbaloo - start simple

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = Yahoo! SearchBar Home Page

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing