Welcome guest. Before posting on our computer help forum, you must register. Click here it's easy and free.

Author Topic: Autoplay Autoplay HiJack This  (Read 12914 times)

0 Members and 1 Guest are viewing this topic.

cliffnook2000

    Topic Starter


    Rookie
    Autoplay Autoplay HiJack This
    « on: November 13, 2007, 04:02:45 AM »
    Hi All,
    Am having trouble with Autoplay taking over my pc. This happens all the time and not just when discs are being used. Sometimes windows explorer will show as many as 15 instances of Autoplay all at the same time. I have posted a message on the XP site about this and was advised to use HijackThis and post the log file here in the hope that some of you smarter guys than me can help.
    So here it is. I have had to chop a bit off as it was over 10000 characters long.
    Anything else you need I can post seperately if needed.
    Cheers  Frank




    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.wanadoo.co.uk/iesearch/default.htm
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.co.uk/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Wanadoo
    F3 - REG:win.ini: load=C:\OPLIMIT\ocraware.exe
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: MSN Search Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\TB\02.05.0000.1082\en-gb\msntb.dll
    O3 - Toolbar: Wanadoo - {8B68564D-53FD-4293-B80C-993A9F3988EE} - C:\PROGRA~1\Wanadoo\WSBar\WSBar.dll
    O3 - Toolbar: MSN Search Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\TB\02.05.0000.1082\en-gb\msntb.dll
    O3 - Toolbar: SYSTRAN Web Translator 5.0  - {A5899B52-3AF9-4F56-85FE-AD7B3BE8490F} - C:\Program Files\SYSTRAN\5.0\Personal\IEPlugIn.dll
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [Dit] Dit.exe
    O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
    O4 - HKLM\..\Run: [Agent] C:\Program Files\Medion\PowerCinema\My_TV\Agent.exe
    O4 - HKLM\..\Run: [CapFax] C:\Program Files\Classic PhoneTools\CapFax.EXE
    O4 - HKLM\..\Run: [POINTER] point32.exe
    O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
    O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
    O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
    O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe
    O4 - HKLM\..\Run: [BrMfcWnd] C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN
    O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl06a\BrStDvPt.exe
    O4 - HKLM\..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe /autorun
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
    O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
    O4 - HKCU\..\Run: [STManager] "C:\Program Files\SpeedTouch\Dr SpeedTouch\drst.exe" -b
    O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
    O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
    O4 - Startup: FAXRX.lnk = C:\Program Files\Brother\Brmfl06a\FAXRX.exe
    O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\MSN Toolbar Suite\DS\02.05.0001.1119\en-gb\bin\WindowsSearch.exe
    O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
    O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
    O8 - Extra context menu item: &MSN Search - res://C:\Program Files\MSN Toolbar Suite\TB\02.05.0000.1082\en-gb\msntb.dll/search.htm
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
    O8 - Extra context menu item: Search with Wanadoo - res://C:\PROGRA~1\Wanadoo\WSBar\WSBar.dll/VSearch.htm
    O9 - Extra button: Casino-on-Net  - {3015DB92-158E-4b77-9020-85C8E311FBB5} - C:\PROGRA~1\CASINO~1\Casino.exe
    O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0819.dll
    O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0819.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: PacificPoker4 - {94EDF7B4-4272-4af3-8F8B-4E2F68E225B7} - C:\PROGRA~1\PACIFI~2\pacificpoker.exe
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra button: Medion-UK - {725E17C7-2B9A-42BA-AAE2-754FA08120BD} - http://www.medion.co.uk (file missing) (HKCU)
    O14 - IERESET.INF: START_PAGE_URL=http://www.wanadoo.co.uk
    O16 - DPF: {0F42F280-2D6E-4B19-95A9-18D8DADB9309} (BFLauncher Class) - http://www.betfred.com/company/gamessections/common/betfredlauncher.cab
    O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab
    O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - http://gamingzone.ubisoft.com/dev/packages/GSManager.cab
    O16 - DPF: {48C20DEE-B00A-11D4-9B2F-0060975D990E} (Hi2Lobby Class) - http://80.253.105.3/lobby/atlclient.cab
    O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EPUWALControl_v1-0-3-17.cab
    O16 - DPF: {94299420-321F-4FF9-A247-62A23EBB640B} (WordMojo Control) - http://mirror.worldwinner.com/games/v45/wordmojo/wordmojo.cab
    O16 - DPF: {CF164902-C4C0-426a-87B3-FB140274E15F} (Dixons PSA) - http://www.gtwebcheck.com/pcworld/28/install/gtdowndi.cab
    O16 - DPF: {F04F4F32-6457-401A-8169-D2773DDFF930} (Yahoo! Photos Easy Upload Tool Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/ydropper/ydropper1_1uk.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{9DEC5791-58D3-4F8D-9143-6A999B9C0C73}: NameServer = 195.92.195.90 195.92.195.91
    O18 - Filter hijack: text/html - {8A8A75D8-C7AD-4C49-87E0-85601BD18621} - (no file)
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
    O23 - Service: Boonty Games - BOONTY - C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe
    O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
    O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

    --

    patio

    • Moderator


    • Genius
    • Maud' Dib
    • Thanked: 1765
      • Yes
    • Experience: Beginner
    • OS: Windows 7
    Re: Autoplay Autoplay HiJack This
    « Reply #1 on: November 13, 2007, 06:14:57 AM »
    The chopped off info is needed as well...use 2 posts if need be.
    " Anyone who goes to a psychiatrist should have his head examined. "

    cliffnook2000

      Topic Starter


      Rookie
      Re: Autoplay Autoplay HiJack This
      « Reply #2 on: November 13, 2007, 06:55:26 AM »

      Ok, thanks.

      This is the top part of the log. Hope it helps

      Thanks

      Frank




      Logfile of Trend Micro HijackThis v2.0.2
      Scan saved at 13:53:44, on 13/11/2007
      Platform: Windows XP SP2 (WinNT 5.01.2600)
      MSIE: Internet Explorer v7.00 (7.00.6000.16544)
      Boot mode: Normal

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\system32\spoolsv.exe
      C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
      C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
      C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
      C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
      C:\WINDOWS\system32\drivers\CDAC11BA.EXE
      C:\WINDOWS\System32\cisvc.exe
      C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
      C:\WINDOWS\System32\nvsvc32.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\ntvdm.exe
      C:\WINDOWS\SOUNDMAN.EXE
      C:\WINDOWS\Dit.exe
      C:\Program Files\Medion\PowerCinema\My_TV\Agent.exe
      C:\Program Files\Classic PhoneTools\CapFax.EXE
      C:\Program Files\Microsoft Hardware\Mouse\point32.exe
      C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
      C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
      C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
      C:\Program Files\iTunes\iTunesHelper.exe
      C:\Program Files\QuickTime\qttask.exe
      C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
      C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
      C:\WINDOWS\system32\ctfmon.exe
      C:\Program Files\Brother\ControlCenter3\brccMCtl.exe
      C:\WINDOWS\system32\RUNDLL32.EXE
      C:\Program Files\Microsoft Money\System\mnyexpr.exe
      C:\Program Files\SpeedTouch\Dr SpeedTouch\drst.exe
      C:\Program Files\WinZip\WZQKPICK.EXE
      C:\Program Files\iPod\bin\iPodService.exe
      C:\Program Files\Brother\Brmfl06a\FAXRX.exe
      C:\WINDOWS\DitExp.exe
      C:\OPLIMIT\ocrawr32.exe
      C:\Program Files\Brother\Brmfcmon\BrMfcmon.exe
      C:\PROGRA~1\SYSTRAN\5.0\Personal\SYSTRA~1.EXE
      C:\WINDOWS\system32\cidaemon.exe
      C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
      C:\WINDOWS\system32\wuauclt.exe
      C:\Program Files\Internet Explorer\IEXPLORE.EXE
      C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

      evilfantasy

      • Malware Removal Specialist
      • Moderator


      • Genius
      • Calm like a bomb
      • Thanked: 489
      • Experience: Familiar
      • OS: Windows 10
      Re: Autoplay Autoplay HiJack This
      « Reply #3 on: November 13, 2007, 09:04:41 AM »
      * Please download Combofix by sUBs. Place it on your Desktop. combofix.exe
      * Double click combofix.exe & follow the prompts. Enter 1 and press enter at the prompt.
      * When finished, it shall produce a log for you. Attach that log in your next reply.
      Combofix will create a backup to anything removed in C:\qoovox

      Note:
      Do not mouseclick combofix's window whilst it's running. That may cause it to stall.

      cliffnook2000

        Topic Starter


        Rookie
        Re: Autoplay Autoplay HiJack This
        « Reply #4 on: November 13, 2007, 11:33:43 PM »
        Ok evilfantasy, thanks. Here goes......

        The Autoplay box appeared for about 20 to 30 times whilst the AutoScan programme was running. At one stage the task bar showed windows explorer with a 6 in front of it. Presumably the number of instances the Autoplay was running.

        Hope it makes sense to you.....Cheers   Frank





        ComboFix 07-11-08.3 - Cliffnook 2007-11-14  6:18:40.1 - NTFSx86
        Running from: C:\Documents and Settings\Cliffnook\Desktop\ComboFix.exe
         * Created a new restore point
        .

        (((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
        .

        C:\WINDOWS\Downloaded Program Files.\hotbar.inf

        .
        (((((((((((((((((((((((((   Files Created from 2007-10-14 to 2007-11-14  )))))))))))))))))))))))))))))))
        .

        2007-11-14 06:16   51,200   --a------   C:\WINDOWS\NirCmd.exe
        2007-11-14 05:54   <DIR>   d--------   C:\WINDOWS\LastGood
        2007-11-14 05:54   271,224   --a------   C:\WINDOWS\system32\mucltui.dll
        2007-11-14 05:54   207,736   --a------   C:\WINDOWS\system32\muweb.dll
        2007-11-13 09:54   267,272   --a------   C:\WINDOWS\system32\xactengine2_10.dll
        2007-11-13 09:52   2,297,552   --a------   C:\WINDOWS\system32\d3dx9_26.dll
        2007-11-13 09:48   <DIR>   d--h-----   C:\WINDOWS\msdownld.tmp
        2007-11-13 06:57   <DIR>   d--------   C:\Documents and Settings\Cliffnook\SecurityScans
        2007-11-13 06:56   <DIR>   d--------   C:\Program Files\Microsoft Baseline Security Analyzer 2
        2007-11-12 07:09   <DIR>   d--------   C:\Documents and Settings\Cliffnook\Application Data\Oberon Media
        2007-11-12 06:49   <DIR>   d--------   C:\Program Files\Trend Micro
        2007-11-09 09:40   <DIR>   d--------   C:\Documents and Settings\Cliffnook\Application Data\VSRevoGroup
        2007-11-09 09:35   <DIR>   d--------   C:\Documents and Settings\All Users\Application Data\RFA_Backups
        2007-11-07 06:41   <DIR>   d--------   C:\Documents and Settings\All Users\Application Data\MinigolfAdventures
        2007-11-05 06:50   <DIR>   d--------   C:\Documents and Settings\Cliffnook\Application Data\ForgottenRiddles
        2007-11-01 09:39   <DIR>   d--------   C:\Program Files\NovaLogic
        2007-10-31 06:22   <DIR>   d--------   C:\Program Files\Oberon Media
        2007-10-23 05:16   <DIR>   d--------   C:\Documents and Settings\All Users\Application Data\Innovative Solutions
        2007-10-22 06:14   <DIR>   d--------   C:\Program Files\VS Revo Group
        2007-10-22 06:11   <DIR>   d--------   C:\Program Files\Your Uninstaller 2006
        2007-10-22 06:11   <DIR>   d--------   C:\Documents and Settings\Cliffnook\Application Data\URSoft
        2007-10-19 06:49   <DIR>   d--------   C:\Documents and Settings\All Users\Application Data\iolo
        2007-10-18 09:36   <DIR>   d--------   C:\Program Files\CCleaner
        2007-10-16 06:19   <DIR>   d--------   C:\Program Files\Croteam

        .
        ((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
        .
        2007-11-13 10:46   ---------   d-----w   C:\Program Files\SpywareBlaster
        2007-11-13 10:41   ---------   d---a-w   C:\Documents and Settings\All Users\Application Data\TEMP
        2007-11-12 07:34   ---------   d--h--w   C:\Program Files\InstallShield Installation Information
        2007-11-12 07:09   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\Oberon Media
        2007-11-09 10:29   ---------   d-----w   C:\Program Files\Betfred Poker
        2007-11-09 09:34   ---------   d-----w   C:\Program Files\Common Files\Oberon Media
        2007-11-09 09:34   ---------   d-----w   C:\Documents and Settings\Cliffnook\Application Data\Pogo Games
        2007-11-09 09:02   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\PlayFirst
        2007-11-07 08:07   ---------   d-----w   C:\Program Files\Microsoft Money
        2007-11-05 06:13   ---------   d-----w   C:\Documents and Settings\Cliffnook\Application Data\PlayFirst
        2007-10-23 08:44   ---------   d-----w   C:\Program Files\PhotoDeluxe 2.0
        2007-10-23 08:44   ---------   d-----w   C:\Program Files\Classic PhoneTools
        2007-10-22 08:43   ---------   d-----w   C:\Documents and Settings\Cliffnook\Application Data\PokerChamps
        2007-10-22 03:37   17,928   ----a-w   C:\WINDOWS\system32\X3DAudio1_2.dll
        2007-10-12 15:14   3,734,536   ----a-w   C:\WINDOWS\system32\d3dx9_36.dll
        2007-10-12 15:14   1,374,232   ----a-w   C:\WINDOWS\system32\D3DCompiler_36.dll
        2007-10-12 10:31   ---------   d-----w   C:\Documents and Settings\Cliffnook\Application Data\AstroMenace
        2007-10-02 09:56   444,776   ----a-w   C:\WINDOWS\system32\d3dx10_36.dll
        2007-10-02 07:56   ---------   d-----w   C:\Program Files\Google
        2007-10-01 05:47   ---------   d-----w   C:\Documents and Settings\Cliffnook\Application Data\VeniceMysteryData
        2007-09-28 08:25   ---------   d-----w   C:\Program Files\Family Tree Maker 2006
        2007-09-24 07:03   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\SugarGames
        2007-09-20 12:16   ---------   d-----w   C:\Program Files\PacificPoker4
        2007-09-20 12:12   ---------   d-----w   C:\Program Files\PacificPoker
        2007-09-14 06:36   ---------   d-----w   C:\Documents and Settings\Cliffnook\Application Data\Big Fish Games
        2007-08-21 06:15   683,520   ----a-w   C:\WINDOWS\system32\inetcomm.dll
        2007-05-01 13:25   7,802   ----a-w   C:\Documents and Settings\Cliffnook\Application Data\wklnhst.dat
        2006-08-25 08:24   1,388   ----a-w   C:\Documents and Settings\Cliffnook\Application Data\ViewerApp.dat
        .

        (((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
        .
        .
        *Note* empty entries & legit default entries are not shown

        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
        "NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2003-10-06 14:16]
        "nwiz"="nwiz.exe" [2003-10-06 14:16 C:\WINDOWS\system32\nwiz.exe]
        "SoundMan"="SOUNDMAN.EXE" [2002-08-15 10:46 C:\WINDOWS\SOUNDMAN.EXE]
        "Dit"="Dit.exe" [2002-08-28 12:43 C:\WINDOWS\Dit.exe]
        "NeroCheck"="C:\WINDOWS\System32\NeroCheck.exe" [2001-07-09 09:50]
        "Agent"="C:\Program Files\Medion\PowerCinema\My_TV\Agent.exe" [2002-09-26 15:49]
        "CapFax"="C:\Program Files\Classic PhoneTools\CapFax.EXE" [2001-12-10 16:34]
        "POINTER"="point32.exe" []
        "Microsoft Works Update Detection"="C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2003-06-09 23:11]
        "AVG7_CC"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" [2007-10-26 05:37]
        "SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 11:38]
        "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2004-12-17 23:20]
        "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-04-12 08:54]
        "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 18:51]
        "SSBkgdUpdate"="C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-10-14 09:22]
        "PaperPort PTD"="C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe" [2005-03-17 13:25]
        "IndexSearch"="C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe" [2005-03-17 13:45]
        "BrMfcWnd"="C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe" [2006-06-28 06:46]
        "SetDefPrt"="C:\Program Files\Brother\Brmfl06a\BrStDvPt.exe" [2005-01-26 17:02]
        "ControlCenter3"="C:\Program Files\Brother\ControlCenter3\brctrcen.exe" [2006-06-29 11:18]

        [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
        "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 07:56]
        "NvMediaCenter"="C:\WINDOWS\System32\NVMCTRAY.DLL" [2003-10-06 14:16]
        "MoneyAgent"="C:\Program Files\Microsoft Money\System\mnyexpr.exe" [2003-06-18 11:00]
        "STManager"="C:\Program Files\SpeedTouch\Dr SpeedTouch\drst.exe" [2003-10-16 13:25]
        "updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" []

        C:\Documents and Settings\Cliffnook\Start Menu\Programs\Startup\
        FAXRX.lnk - C:\Program Files\Brother\Brmfl06a\FAXRX.exe [2007-09-05 07:43:46]

        C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
        Windows Desktop Search.lnk - C:\Program Files\MSN Toolbar Suite\DS\02.05.0001.1119\en-gb\bin\WindowsSearch.exe [2005-09-20 17:10:04]
        WinZip Quick Pick.lnk - C:\Program Files\WinZip\WZQKPICK.EXE [2003-07-22 10:39:53]

        R1 ATMhelpr;ATMhelpr;C:\WINDOWS\system32\drivers\ATMhelpr.sys
        R3 BrScnUsb;Brother USB Still Image driver;C:\WINDOWS\system32\DRIVERS\BrScnUsb.sys
        R3 BrSerIf;Brother MFC Serial Port Interface WDM Driver;C:\WINDOWS\system32\Drivers\BrSerIf.sys
        R3 BrUsbSer;Brother MFC USB Serial WDM Driver;C:\WINDOWS\system32\Drivers\BrUsbSer.sys
        S2 UMAXPCLS;Print Port Scanner Driver;C:\WINDOWS\system32\DRIVERS\umaxpcls.sys
        S3 Boonty Games;Boonty Games;"C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe"
        S3 Cap7134;MEDION (7134) WDM Video Capture;C:\WINDOWS\system32\DRIVERS\Cap7134.sys
        S3 IIUSBISP;USB Mass Storage for USB ISP;C:\WINDOWS\system32\Drivers\iiusbisp.sys
        S3 Intels51;Creatix V.9X DSP Data Fax Modem;C:\WINDOWS\system32\DRIVERS\ctxs51.sys
        S3 JL2005;JL2005A Toy Camera;C:\WINDOWS\system32\Drivers\toywdm.sys
        S3 PhTVTune;MEDION TV-TUNER 7134 MK2/3;C:\WINDOWS\system32\DRIVERS\PhTVTune.sys

        *Newly Created Service* - CATCHME
        .
        **************************************************************************

        catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
        Rootkit scan 2007-11-14 06:21:25
        Windows 5.1.2600 Service Pack 2 NTFS

        scanning hidden processes ...

        scanning hidden autostart entries ...

        scanning hidden files ...

        scan completed successfully
        hidden files: 0

        **************************************************************************
        .
        Completion time: 2007-11-14  6:22:09
        .
           --- E O F ---

        evilfantasy

        • Malware Removal Specialist
        • Moderator


        • Genius
        • Calm like a bomb
        • Thanked: 489
        • Experience: Familiar
        • OS: Windows 10
        Re: Autoplay Autoplay HiJack This
        « Reply #5 on: November 14, 2007, 12:02:46 AM »
        Please download ATF Cleaner by Atribune. ATF Cleaner.exe This program does not require an installation. The executable actually runs the program.

        NOTE: ATF Cleaner will remove all files from the items that are checked so if you have some cookies you'd like to save. Please move them to a different directory first.
        * Double-click ATF-Cleaner.exe to run the program.
        * Under Main choose: Select All
        * Click the Empty Selected button.

        If you use Firefox browser
        * Click Firefox at the top and choose: Select All
        * Click the Empty Selected button.
        NOTE: If you would like to keep your saved passwords, please click No at the prompt.

        If you use Opera browser
        * Click Opera at the top and choose: Select All
        * Click the Empty Selected button.
        NOTE: If you would like to keep your saved passwords, please click No at the prompt.

        Click Exit on the Main ATF Cleaner menu to close the program.

        ==========

        Please read carefully

        Run the BitDefender Online Scanner
        Agree to the license and then select Scan.
        DO NOT CHANGE THE OPTIONS TO SHOW ALL FILES SCANNED.
        That will make your logs huge and we don't need to see clean files.

        Once Bitdefender completes the scan:
        Click-on the Detected Problems tab.
        Then select Click here to export the scan report.

        When the window comes up to save the report, change the Save as type: box to:
        Text (Tab Delimited) (*.txt) and then in the File name box enter change to bdscan then click Save.

        This will save a file named bdscan.txt. I would suggest saving it to the Desktop so you can easily find it. (take notice of where you save it so you can find it later).
        This bdcan.txt file will actually contain HTML code that we can easily view later while reviewing your log. All we have to do is rename the file to bdscan.html.

        If you do not follow these step, you will have an incorrect log or worse a log summary which is useless to us.

        Post the bdscan.txt file.

        ==========
        Next post please add
        BitDefender log
        New HijackThis log

        Tell me how things are now

        cliffnook2000

          Topic Starter


          Rookie
          Re: Autoplay Autoplay HiJack This
          « Reply #6 on: November 14, 2007, 06:10:23 AM »
          Ok ...Done all that but the files are a bit big and i'm probably going to need 4 replies to get them both across. Is this ok or is there a way to send as attachments?

          Cheers Frank

          patio

          • Moderator


          • Genius
          • Maud' Dib
          • Thanked: 1765
            • Yes
          • Experience: Beginner
          • OS: Windows 7
          Re: Autoplay Autoplay HiJack This
          « Reply #7 on: November 14, 2007, 06:36:38 AM »
          Frank you can use as many as are needed....
          " Anyone who goes to a psychiatrist should have his head examined. "

          cliffnook2000

            Topic Starter


            Rookie
            Re: Autoplay Autoplay HiJack This
            « Reply #8 on: November 14, 2007, 06:43:59 AM »
            Ok Patio...thanks.
            Here goes then......bdscan.txt file will be first two posts and new HiJackThis will be next 2
            <HTML>
            <HEAD>
            <TITLE>BitDefender Online Scanner -Scan Report</TITLE>
            <META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
            <meta name="generator" content="Namo WebEditor v5.0(Trial)">
            </HEAD>
            <BODY BGCOLOR=#FFFFFF  leftmargin="10" marginwidth="0" topmargin="20" marginheight="0" >


            <table align="center" border="0" cellpadding="0" cellspacing="0" width="90%">
                <tr>
                    <td width="458">
                        <p><font face="Arial" color=red><span style="font-size:14pt;">BitDefender
                        Online Scanner
            </span></font></p>
                    </td>
                    <td width="40%">
                        <p>&nbsp;</p>
                    </td>
                    <td width="10%">
                        <p>&nbsp;</p>
                    </td>
                </tr>
                <tr>
                    <td colspan="3" width="912">
                        <p><font face="Arial"><span style="font-size:11pt;"><B>Scan report generated
                        at: Wed, Nov 14, 2007 - 12:32:40</span></font></p>
                    </td>
                </tr>

               <tr>
                    <td width="458">
                        <p><font face="Arial"><span style="font-size:11pt;"><B>&nbsp;</span></font></p>
                    </td>
                    <td width="40%">
                        <p>&nbsp;</p>
                    </td>
                    <td width="10%">
                        <p>&nbsp;</p>
                    </td>
                </tr>

               <tr>
                    <td width="458">
                        <p><font face="Arial"><span style="font-size:11pt;"><B>Scan
                        path: </span><span style="font-size:10pt;">A:\;C:\;D:\;E:\;F:\;G:\;H:\;I:\;J:\;K:\;L:\;</span></font></p>
                    </td>
                    <td width="40%">
                        <p>&nbsp;</p>
                    </td>
                    <td width="10%">
                        <p>&nbsp;</p>
                    </td>
                </tr>

               <tr>
                    <td width="458">
                        <p><font face="Arial"><span style="font-size:11pt;"><B>&nbsp;</span></font></p>
                    </td>
                    <td width="40%">
                        <p>&nbsp;</p>
                    </td>
                    <td width="10%">
                        <p>&nbsp;</p>
                    </td>
                </tr>

                <tr>
                    <td width="458">
                            <table border="1" cellspacing="0" bordercolordark="white" bordercolorlight="black" width="100%">
                                <tr>
                                    <td width="451" colspan="2" bgcolor="#CCCCCC">
                                        <p><font face="Arial" size="2"><B>Statistics</font></p>
                                    </td>
                                </tr>
                                <tr>
                                    <td width="57%">
                                        <p><font face="Arial" size="2">Time</font></p>
                                    </td>
                                    <td width="43%" align="right">
                                        <p><font face="Arial" size="2">01:09:25</font></p>
                                    </td>
                                </tr>
                                <tr>
                                    <td width="57%">
                                        <p><font face="Arial" size="2">Files</font></p>
                                    </td>
                                    <td width="43%" align="right">
                                        <p><font face="Arial" size="2">285820</font></p>
                                    </td>
                                </tr>
                                <tr>
                                    <td width="57%">
                                        <p><font face="Arial" size="2">Folders</font></p>
                                    </td>
                                    <td width="43%" align="right">
                                        <p><font face="Arial" size="2">7494</font></p>
                                    </td>
                                </tr>
                                <tr>
                                    <td width="57%">
                                        <p><font face="Arial" size="2">Boot Sectors</font></p>
                                    </td>
                                    <td width="43%" align="right">
                                        <p><font face="Arial" size="2">5</font></p>
                                    </td>
                                </tr>
                                <tr>
                                    <td width="57%">
                                        <p><font face="Arial" size="2">Archives</font></p>
                                    </td>
                                    <td width="43%" align="right">
                                        <p><font face="Arial" size="2">8698</font></p>
                                    </td>
                                </tr>
                                <tr>
                                    <td width="57%">
                                        <p><font face="Arial" size="2">Packed Files</font></p>
                                    </td>
                                    <td width="43%" align="right">
                                        <p><font face="Arial" size="2">10319</font></p>
                                    </td>
                                </tr>
                            </table>
                    </td>
                    <td width="40%">
                        <p>&nbsp;</p>
                    </td>
                    <td width="10%">
                        <p>&nbsp;</p>
                    </td>
                </tr>

               

               <tr>
                    <td width="458">
                            <table border="1" cellspacing="0" bordercolordark="white" bordercolorlight="black" width="100%">
                                <tr>
                                    <td width="451" colspan="2" bgcolor="#CCCCCC">
                                        <p><font face="Arial" size="2"><B>Results</font></p>
                                    </td>
                                </tr>
                                <tr>
                                    <td width="57%">
                                    <p><font face="Arial" size="2">Identified Viruses </font></p>
                                    </td>
                                    <td width="43%" align="right">
                                        <p><font face="Arial" size="2">2</font></p>
                                    </td>
                                </tr>
                                <tr>
                                    <td width="57%">
                                    <p><font face="Arial" size="2">Infected Files </font></p>
                                    </td>
                                    <td width="43%" align="right">
                                        <p><font face="Arial" size="2">2</font></p>
                                    </td>
                                </tr>
                                <tr>
                                    <td width="57%">
                                    <p><font face="Arial" size="2">Suspect&nbsp;Files </font></p>
                                    </td>
                                    <td width="43%" align="right">
                                        <p><font face="Arial" size="2">0</font></p>
                                    </td>
                                </tr>
                                <tr>
                                    <td width="57%">
                                        <p><font face="Arial" size="2">Warnings</font></p>
                                    </td>
                                    <td width="43%" align="right">
                                        <p><font face="Arial" size="2">0</font></p>
                                    </td>
                                </tr>
                                <tr>
                                    <td width="57%">
                                        <p><font face="Arial" size="2">Disinfected</font></p>
                                    </td>
                                    <td width="43%" align="right">
                                        <p><font face="Arial" size="2">0</font></p>
                                    </td>
                                </tr>
                                <tr>
                                    <td width="57%">
                                        <p><font face="Arial" size="2">Deleted Files</font></p>
                                    </td>
                                    <td width="43%" align="right">
                                        <p><font face="Arial" size="2">2</font></p>
                                    </td>
                                </tr>
                            </table>
                    </td>
                    <td width="40%">
                        <p>&nbsp;</p>
                    </td>
                    <td width="10%">
                        <p>&nbsp;</p>
                    </td>
                </tr>

               <tr>
                    <td width="458">
                            <table border="1" cellspacing="0" bordercolordark="white" bordercolorlight="black" width="100%">
                                <tr>
                                    <td width="451" colspan="2" bgcolor="#CCCCCC">
                                        <p><font face="Arial" size="2"><B>Engines Info</font></p>
                                    </td>
                                </tr>
                                <tr>
                                    <td width="57%">
                                    <p><font face="Arial" size="2">Virus Definitions</font></p>
                                    </td>
                                    <td width="43%" align="right">
                                        <p><font face="Arial" size="2">872698</font></p>
                                    </td>
                                </tr>
                                <tr>
                                    <td width="57%">
                                    <p><font face="Arial" size="2">Engine build</font></p>
                                    </td>
                                    <td width="43%" align="right">
                                        <p><font face="Arial" size="2">AVCORE v1.0 (build 2422) (i386) (Sep 25 2007 08:26:36)</font></p>
                                    </td>
                                </tr>
                                <tr>
                     

            cliffnook2000

              Topic Starter


              Rookie
              Re: Autoplay Autoplay HiJack This
              « Reply #9 on: November 14, 2007, 06:46:33 AM »
              <td width="57%">
                                          <p><font face="Arial" size="2">Scan plugins</font></p>
                                      </td>
                                      <td width="43%" align="right">
                                          <p><font face="Arial" size="2">14</font></p>
                                      </td>
                                  </tr>
                                  <tr>
                                      <td width="57%">
                                          <p><font face="Arial" size="2">Archive plugins</font></p>
                                      </td>
                                      <td width="43%" align="right">
                                          <p><font face="Arial" size="2">38</font></p>
                                      </td>
                                  </tr>
                                  <tr>
                                      <td width="57%">
                                          <p><font face="Arial" size="2">Unpack plugins</font></p>
                                      </td>
                                      <td width="43%" align="right">
                                          <p><font face="Arial" size="2">7</font></p>
                                      </td>
                                  </tr>
                                  <tr>
                                      <td width="57%">
                                          <p><font face="Arial" size="2">E-mail plugins</font></p>
                                      </td>
                                      <td width="43%" align="right">
                                          <p><font face="Arial" size="2">6</font></p>
                                      </td>
                                  </tr>
                                  <tr>
                                      <td width="57%">
                                          <p><font face="Arial" size="2">System&nbsp;plugins</font></p>
                                      </td>
                                      <td width="43%" align="right">
                                          <p><font face="Arial" size="2">1</font></p>
                                      </td>
                                  </tr>
                              </table>
                      </td>
                      <td width="40%">
                          <p>&nbsp;</p>
                      </td>
                      <td width="10%">
                          <p>&nbsp;</p>
                      </td>
                  </tr>

                 <tr>
                      <td width="458">
                              <table border="1" cellspacing="0" bordercolordark="white" bordercolorlight="black" width="100%">
                                  <tr>
                                      <td width="451" colspan="2" bgcolor="#CCCCCC">
                                          <p><font face="Arial" size="2"><B>Scan Settings</font></p>
                                      </td>
                                  </tr>
                                  <tr>
                                      <td width="57%">
                                      <p><font face="Arial" size="2">First Action</font></p>
                                      </td>
                                      <td width="43%" align="right">
                                          <p><font face="Arial" size="2">Disinfect</font></p>
                                      </td>
                                  </tr>
                                  <tr>
                                      <td width="57%">
                                      <p><font face="Arial" size="2">Second Action</font></p>
                                      </td>
                                      <td width="43%" align="right">
                                          <p><font face="Arial" size="2">Delete</font></p>
                                      </td>
                                  </tr>
                                  <tr>
                                      <td width="57%">
                                          <p><font face="Arial" size="2">Heuristics</font></p>
                                      </td>
                                      <td width="43%" align="right">
                                          <p><font face="Arial" size="2">Yes</font></p>
                                      </td>
                                  </tr>
                                  <tr>
                                      <td width="57%">
                                          <p><font face="Arial" size="2">Enable Warnings</font></p>
                                      </td>
                                      <td width="43%" align="right">
                                          <p><font face="Arial" size="2">Yes</font></p>
                                      </td>
                                  </tr>
                                 <tr>
                                      <td width="57%">
                                          <p><font face="Arial" size="2">Scanned Extensions</font></p>
                                      </td>
                                      <td width="43%" align="right">
                                          <p><font face="Arial" size="2">*;</font></p>
                                      </td>
                                  </tr>

                                  <tr>
                                      <td width="57%">
                                          <p><font face="Arial" size="2">Exclude Extensions</font></p>
                                      </td>
                                      <td width="43%" align="right">
                                          <p><font face="Arial" size="2">&nbsp;</font></p>
                                      </td>
                                  </tr>
                                  <tr>
                                      <td width="57%">
                                          <p><font face="Arial" size="2">Scan Emails</font></p>
                                      </td>
                                      <td width="43%" align="right">
                                          <p><font face="Arial" size="2">Yes</font></p>
                                      </td>
                                  </tr>
                                  <tr>
                                      <td width="57%">
                                          <p><font face="Arial" size="2">Scan Archives</font></p>
                                      </td>
                                      <td width="43%" align="right">
                                          <p><font face="Arial" size="2">Yes</font></p>
                                      </td>
                                  </tr>
                                  <tr>
                                      <td width="57%">
                                          <p><font face="Arial" size="2">Scan Packed</font></p>
                                      </td>
                                      <td width="43%" align="right">
                                          <p><font face="Arial" size="2">Yes</font></p>
                                      </td>
                                  </tr>
                                  <tr>
                                      <td width="57%">
                                          <p><font face="Arial" size="2">Scan Files</font></p>
                                      </td>
                                      <td width="43%" align="right">
                                          <p><font face="Arial" size="2">Yes</font></p>
                                      </td>
                                  </tr>
                                  <tr>
                                      <td width="57%">
                                          <p><font face="Arial" size="2">Scan Boot</font></p>
                                      </td>
                                      <td width="43%" align="right">
                                          <p><font face="Arial" size="2">Yes</font></p>
                                      </td>
                                  </tr>
                              </table>
                      </td>
                      <td width="40%">
                          <p>&nbsp;</p>
                      </td>
                      <td width="10%">
                          <p>&nbsp;</p>
                      </td>
                  </tr>

                 <tr>
                      <td colspan=2> &nbsp;
                              <table border="1" cellspacing="0" bordercolordark="white" bordercolorlight="black" width="100%">
                                  <tr>
                                      <td width="252" bgcolor="#CCCCCC">
                                          <p><font face="Arial" size="2"><B>Scanned File</font></p>
                                      </td>
                                      <td width="195" bgcolor="#CCCCCC" align="right">
                                      <p align="left"><font size="2" face="Arial">&nbsp;Status</font></p>
                                      </td>
                                  </tr>
                                  <tr>
                 <td width="57%">
                 <p><font face="Arial" size="2">C:\WINDOWS\system32\70000041.exe</font></p>
                 </td>
                 <td width="43%" align="left">
                    <p><font face="Arial" size="2">Infected with: DeepScan:Generic.Malware.dld!!.0053513A</font></p>
                 </td>
              </tr><tr>
                 <td width="57%">
                 <p><font face="Arial" size="2">C:\WINDOWS\system32\70000041.exe</font></p>
                 </td>
                 <td width="43%" align="left">
                    <p><font face="Arial" size="2">Disinfection failed</font></p>
                 </td>
              </tr><tr>
                 <td width="57%">
                 <p><font face="Arial" size="2">C:\WINDOWS\system32\70000041.exe</font></p>
                 </td>
                 <td width="43%" align="left">
                    <p><font face="Arial" size="2">Deleted</font></p>
                 </td>
              </tr><tr>
                 <td width="57%">
                 <p><font face="Arial" size="2">C:\WINDOWS\system32\gtdowndi_86.ocx</font></p>
                 </td>
                 <td width="43%" align="left">
                    <p><font face="Arial" size="2">Infected with: Trojan.Dloader.VP</font></p>
                 </td>
              </tr><tr>
                 <td width="57%">
                 <p><font face="Arial" size="2">C:\WINDOWS\system32\gtdowndi_86.ocx</font></p>
                 </td>
                 <td width="43%" align="left">
                    <p><font face="Arial" size="2">Disinfection failed</font></p>
                 </td>
              </tr><tr>
                 <td width="57%">
                 <p><font face="Arial" size="2">C:\WINDOWS\system32\gtdowndi_86.ocx</font></p>
                 </td>
                 <td width="43%" align="left">
                    <p><font face="Arial" size="2">Deleted</font></p>
                 </td>
              </tr>
                              </table>
                      </td>
                     
                      <td width="10%">
                          <p>&nbsp;</p>
                      </td>
                  </tr>

                 <tr>
                      <td width="458">
                          <p><font face="Arial"><span style="font-size:11pt;"><B>&nbsp;</span></font></p>
                      </td>
                      <td width="40%">
                          <p>&nbsp;</p>
                      </td>
                      <td width="10%">
                          <p>&nbsp;</p>
                      </td>
                  </tr>

                 <tr>
                      <td width="458">
                          <p><font face="Arial"><span style="font-size:11pt;"><B>&nbsp;</span></font></p>
                      </td>
                      <td width="40%">
                          <p>&nbsp;</p>
                      </td>
                      <td width="10%">
                          <p>&nbsp;</p>
                      </td>
                  </tr>

              </table>
              <p>&nbsp;</p>

              </body>
              </html>

              cliffnook2000

                Topic Starter


                Rookie
                Re: Autoplay Autoplay HiJack This
                « Reply #10 on: November 14, 2007, 06:47:44 AM »
                ogfile of Trend Micro HijackThis v2.0.2
                Scan saved at 12:57:33, on 14/11/2007
                Platform: Windows XP SP2 (WinNT 5.01.2600)
                MSIE: Internet Explorer v7.00 (7.00.6000.16544)
                Boot mode: Normal

                Running processes:
                C:\WINDOWS\System32\smss.exe
                C:\WINDOWS\system32\winlogon.exe
                C:\WINDOWS\system32\services.exe
                C:\WINDOWS\system32\lsass.exe
                C:\WINDOWS\system32\svchost.exe
                C:\WINDOWS\System32\svchost.exe
                C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
                C:\WINDOWS\system32\spoolsv.exe
                C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
                C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
                C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
                C:\WINDOWS\system32\drivers\CDAC11BA.EXE
                C:\WINDOWS\System32\cisvc.exe
                C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
                C:\WINDOWS\System32\nvsvc32.exe
                C:\WINDOWS\System32\svchost.exe
                C:\WINDOWS\SOUNDMAN.EXE
                C:\WINDOWS\Dit.exe
                C:\Program Files\Medion\PowerCinema\My_TV\Agent.exe
                C:\Program Files\Classic PhoneTools\CapFax.EXE
                C:\Program Files\Microsoft Hardware\Mouse\point32.exe
                C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
                C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
                C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
                C:\Program Files\iTunes\iTunesHelper.exe
                C:\Program Files\QuickTime\qttask.exe
                C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
                C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
                C:\WINDOWS\system32\ctfmon.exe
                C:\Program Files\Brother\ControlCenter3\brccMCtl.exe
                C:\Program Files\Microsoft Money\System\mnyexpr.exe
                C:\Program Files\iPod\bin\iPodService.exe
                C:\Program Files\SpeedTouch\Dr SpeedTouch\drst.exe
                C:\WINDOWS\DitExp.exe
                C:\Program Files\Brother\Brmfcmon\BrMfcmon.exe
                C:\Program Files\WinZip\WZQKPICK.EXE
                C:\OPLIMIT\ocrawr32.exe
                C:\Program Files\Brother\Brmfl06a\FAXRX.exe
                C:\WINDOWS\system32\cidaemon.exe
                C:\PROGRA~1\SYSTRAN\5.0\Personal\SYSTRA~1.EXE
                C:\WINDOWS\explorer.exe
                C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

                cliffnook2000

                  Topic Starter


                  Rookie
                  Re: Autoplay Autoplay HiJack This
                  « Reply #11 on: November 14, 2007, 06:57:35 AM »
                  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.co.uk/
                  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
                  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
                  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
                  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
                  O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
                  O2 - BHO: MSN Search Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\TB\02.05.0000.1082\en-gb\msntb.dll
                  O3 - Toolbar: Wanadoo - {8B68564D-53FD-4293-B80C-993A9F3988EE} - C:\PROGRA~1\Wanadoo\WSBar\WSBar.dll
                  O3 - Toolbar: MSN Search Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\TB\02.05.0000.1082\en-gb\msntb.dll
                  O3 - Toolbar: SYSTRAN Web Translator 5.0  - {A5899B52-3AF9-4F56-85FE-AD7B3BE8490F} - C:\Program Files\SYSTRAN\5.0\Personal\IEPlugIn.dll
                  O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
                  O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
                  O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
                  O4 - HKLM\..\Run: [Dit] Dit.exe
                  O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
                  O4 - HKLM\..\Run: [Agent] C:\Program Files\Medion\PowerCinema\My_TV\Agent.exe
                  O4 - HKLM\..\Run: [CapFax] C:\Program Files\Classic PhoneTools\CapFax.EXE
                  O4 - HKLM\..\Run: [POINTER] point32.exe
                  O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
                  O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
                  O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
                  O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
                  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                  O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
                  O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
                  O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
                  O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe
                  O4 - HKLM\..\Run: [BrMfcWnd] C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN
                  O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl06a\BrStDvPt.exe
                  O4 - HKLM\..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe /autorun
                  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
                  O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
                  O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
                  O4 - HKCU\..\Run: [STManager] "C:\Program Files\SpeedTouch\Dr SpeedTouch\drst.exe" -b
                  O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
                  O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
                  O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
                  O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
                  O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
                  O4 - Startup: FAXRX.lnk = C:\Program Files\Brother\Brmfl06a\FAXRX.exe
                  O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\MSN Toolbar Suite\DS\02.05.0001.1119\en-gb\bin\WindowsSearch.exe
                  O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
                  O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
                  O8 - Extra context menu item: &MSN Search - res://C:\Program Files\MSN Toolbar Suite\TB\02.05.0000.1082\en-gb\msntb.dll/search.htm
                  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
                  O8 - Extra context menu item: Search with Wanadoo - res://C:\PROGRA~1\Wanadoo\WSBar\WSBar.dll/VSearch.htm
                  O9 - Extra button: Casino-on-Net  - {3015DB92-158E-4b77-9020-85C8E311FBB5} - C:\PROGRA~1\CASINO~1\Casino.exe
                  O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0819.dll
                  O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0819.dll
                  O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
                  O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
                  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
                  O9 - Extra button: PacificPoker4 - {94EDF7B4-4272-4af3-8F8B-4E2F68E225B7} - C:\PROGRA~1\PACIFI~2\pacificpoker.exe
                  O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
                  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                  O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                  O9 - Extra button: Medion-UK - {725E17C7-2B9A-42BA-AAE2-754FA08120BD} - http://www.medion.co.uk (file missing) (HKCU)
                  O14 - IERESET.INF: START_PAGE_URL=http://www.wanadoo.co.uk
                  O16 - DPF: {0F42F280-2D6E-4B19-95A9-18D8DADB9309} (BFLauncher Class) - http://www.betfred.com/company/gamessections/common/betfredlauncher.cab
                  O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab
                  O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - http://gamingzone.ubisoft.com/dev/packages/GSManager.cab
                  O16 - DPF: {48C20DEE-B00A-11D4-9B2F-0060975D990E} (Hi2Lobby Class) - http://80.253.105.3/lobby/atlclient.cab
                  O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EPUWALControl_v1-0-3-17.cab
                  O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
                  O16 - DPF: {94299420-321F-4FF9-A247-62A23EBB640B} (WordMojo Control) - http://mirror.worldwinner.com/games/v45/wordmojo/wordmojo.cab
                  O16 - DPF: {CF164902-C4C0-426a-87B3-FB140274E15F} (Dixons PSA) - http://www.gtwebcheck.com/pcworld/28/install/gtdowndi.cab
                  O16 - DPF: {F04F4F32-6457-401A-8169-D2773DDFF930} (Yahoo! Photos Easy Upload Tool Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/ydropper/ydropper1_1uk.cab
                  O17 - HKLM\System\CCS\Services\Tcpip\..\{9DEC5791-58D3-4F8D-9143-6A999B9C0C73}: NameServer = 195.92.195.91 195.92.195.90
                  O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
                  O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
                  O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
                  O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
                  O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
                  O23 - Service: Boonty Games - BOONTY - C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe
                  O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
                  O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
                  O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

                  --
                  End of file - 10429 bytes

                  Hope i've done it right. If not I'll just have to give it another go.

                  Cheers Frank

                  evilfantasy

                  • Malware Removal Specialist
                  • Moderator


                  • Genius
                  • Calm like a bomb
                  • Thanked: 489
                  • Experience: Familiar
                  • OS: Windows 10
                  Re: Autoplay Autoplay HiJack This
                  « Reply #12 on: November 14, 2007, 08:35:16 AM »
                  The Bitdefender removed a couple of nasties so we are getting there.


                  Couple of questions.

                  Wanadoo toolbar <---Is this something you installed and do you use it?

                  More info on this toolbar ---> Click here

                  Boonty Games <---Is this something you installed and do you use it?

                  More info on this ---> Click here

                  I think it is best we remove these.

                  Also how are things now?

                  cliffnook2000

                    Topic Starter


                    Rookie
                    Re: Autoplay Autoplay HiJack This
                    « Reply #13 on: November 14, 2007, 01:36:03 PM »
                    Ok, to answer your questions.

                    My service provider is Wanadoo (now orange) and this was presumably installed when I first started using this service. I need a toolbar but it doesn't have to be this one.

                    Boonty games can go. It must be still there from when I downloaded a trial from the internet.

                    I will need some advice on how to get rid of these and what toolbar would you suggest instead

                    Unfortunately, although the pc does seem to be running faster, I have still the same problems with Autoplay.

                    You guys obviously know your business and I feel more confident now that we will get there in the end.

                    Thanks for all your help so far

                    Cheers  Frank

                    evilfantasy

                    • Malware Removal Specialist
                    • Moderator


                    • Genius
                    • Calm like a bomb
                    • Thanked: 489
                    • Experience: Familiar
                    • OS: Windows 10
                    Re: Autoplay Autoplay HiJack This
                    « Reply #14 on: November 14, 2007, 01:43:00 PM »
                    OK, lets tackle the Autoplay first. I wanted to make sure there was no malware to interfere with any fixes we attempt with it.

                    The Wanadoo I will look into but I do know the Boonty will involve some detailed removal instructions.

                    Anyway.....this should be pain free

                    Use the Autoplay Repair Wizard

                    Let me know how that goes.