I continue to have problems with errors on device drivers and saw the Hijack This reference so ran the free download and resulted in identifying several high threats - so had to purchase software to remove. Here is the log from Hijack This. Anyone who can understand and advise if identified threats were causing the problems (major concerns with Trojan/CWS combo)? Sorry for all the stuff - I to delete alot not sure if took out valuable stuff.
<?xml version = "1.0"?>
<Session START = "14 Nov 05 20:16:15" END = "14 Nov 05 20:16:15">
<Information Version = "4.17" DatabaseVersion = "127" DataBaseDate = "8 Nov 2005"/>
<PROCESS NAME = "C:\WINDOWS\system32\services.exe" MD5 = "c6ce6eec82f187615d1002bb3bb50ed4"/>
<PROCESS NAME = "C:\WINDOWS\system32\lsass.exe" MD5 = "84885f9b82f4d55c6146ebf6065d75d2"/>
<PROCESS NAME = "C:\WINDOWS\system32\Ati2evxx.exe" MD5 = "d24907c31a3004a560385e5048c72dd7"/>
<PROCESS NAME = "C:\WINDOWS\system32\svchost.exe" MD5 = "8f078ae4ed187aaabc0a305146de6716"/>
<PROCESS NAME = "C:\WINDOWS\system32\svchost.exe" MD5 = "8f078ae4ed187aaabc0a305146de6716"/>
<PROCESS NAME = "C:\WINDOWS\System32\svchost.exe" MD5 = "8f078ae4ed187aaabc0a305146de6716"/>
<PROCESS NAME = "C:\WINDOWS\System32\svchost.exe" MD5 = "8f078ae4ed187aaabc0a305146de6716"/>
<PROCESS NAME = "C:\WINDOWS\System32\svchost.exe" MD5 = "8f078ae4ed187aaabc0a305146de6716"/>
<PROCESS NAME = "C:\WINDOWS\system32\spoolsv.exe" MD5 = "da81ec57acd4cdc3d4c51cf3d409af9f"/>
<PROCESS NAME = "C:\Program Files\Network Associates\Common Framework\FrameworkService.exe" MD5 = "a80f0e7dc789150c3ae4f504e3b96b06"/>
<PROCESS NAME = "C:\Program Files\Network Associates\VirusScan\mcshield.exe" MD5 = "fe7985dae11fa70829762c5af39dbb27"/>
<PROCESS NAME = "C:\Program Files\Network Associates\VirusScan\vstskmgr.exe" MD5 = "dae0d925fa8d4aec46e924a136b93a32"/>
<PROCESS NAME = "C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe" MD5 = "331b69d20d0983b93baf2f7e6daebb80"/>
<PROCESS NAME = "C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe" MD5 = "0efee4f2d23ba2d8b27fba942106e0e1"/>
<PROCESS NAME = "C:\WINDOWS\System32\svchost.exe" MD5 = "8f078ae4ed187aaabc0a305146de6716"/>
<PROCESS NAME = "C:\WINDOWS\system32\wdfmgr.exe" MD5 = "ab0a7ca90d9e3d6a193905dc1715ded0"/>
<PROCESS NAME = "C:\WINDOWS\System32\alg.exe" MD5 = "f1958fbf86d5c004cf19a5951a9514b7"/>
<PROCESS NAME = "C:\WINDOWS\system32\Ati2evxx.exe" MD5 = "d24907c31a3004a560385e5048c72dd7"/>
<PROCESS NAME = "C:\WINDOWS\Explorer.EXE" MD5 = "a0732187050030ae399b241436565e64"/>
<PROCESS NAME = "C:\WINDOWS\System32\svchost.exe" MD5 = "8f078ae4ed187aaabc0a305146de6716"/>
<PROCESS NAME = "C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe" MD5 = "3f261a8554d95d66009863dcff1b2f72"/>
<PROCESS NAME = "C:\Program Files\Intuit\QAgent\QAGENT.EXE" MD5 = "5b55861c2ce7d72d8e55f98ffbf95fb8"/>
<PROCESS NAME = "C:\WINDOWS\system32\carpserv.exe" MD5 = "ea3be7f5cdef0fe4df1bf6dbfe7abde0"/>
<PROCESS NAME = "C:\Program Files\Microsoft Hardware\Keyboard\type32.exe" MD5 = "b5eca5948d7f8eaa00333231f33ea31a"/>
<PROCESS NAME = "C:\WINDOWS\SOUNDMAN.EXE" MD5 = "d968b3259421c4a0627a62f4e0e96d6d"/>
<PROCESS NAME = "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" MD5 = "c6fa9370324cde99ec1c3f4a22a9be56"/>
<PROCESS NAME = "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" MD5 = "7fdd96f93adbe7e986aabae0ca446011"/>
<PROCESS NAME = "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" MD5 = "e4a7b1aa1e40676153a824ac00ec3450"/>
<PROCESS NAME = "C:\Program Files\Common Files\Network Associates\TalkBack\tbmon.exe" MD5 = "78915c3ad0024bacd46f41bf02ee4415"/>
<PROCESS NAME = "C:\Program Files\iTunes\iTunesHelper.exe" MD5 = "1c2b9fcd48112b0297b83e7fc43d1b42"/>
<PROCESS NAME = "C:\Program Files\QuickTime\qttask.exe" MD5 = "3e7d91f24d28c968b92c85c7e2882eed"/>
<PROCESS NAME = "C:\Program Files\Hewlett-Packard\HP OfficeJet Series 500\Bin\HPOstr05.exe" MD5 = "1666422fbd939586b1e54edad87e3c94"/>
<PROCESS NAME = "C:\Program Files\iPod\bin\iPodService.exe" MD5 = "5590c0e3b40c924c2b94cb5868b8360a"/>
<PROCESS NAME = "C:\Program Files\Hewlett-Packard\HP OfficeJet Series 500\bin\HPOVDX05.EXE" MD5 = "83fe7a2a31fab5afd2ba5ef8cb0bb530"/>
<PROCESS NAME = "C:\WINDOWS\system32\hpoipm07.exe" MD5 = "dac39ffd1bce3b239616226b47594ab4"/>
<PROCESS NAME = "C:\Program Files\Internet Explorer\iexplore.exe" MD5 = "e7484514c0464642be7b4dc2689354c8"/>
<PROCESS NAME = "C:\Program Files\XoftSpy\XoftSpy.exe" MD5 = "8107deb204f560cd5e8326d6364f56db"/>
<ScanningRegKeys>
</ScanningRegKeys>
<ScanningRegValues>
</SW>
<SW NAME = "Lycos Sidesearch">
<REGVALUE VALUE = "Lycos Sidesearch Software\Microsoft\Internet Explorer\extensions\cmdmapping\{000007c6-17df-4438-92a4-de5537471ba3}"/>
<REGVALUEFOUND NAME = "Software\Microsoft\Internet Explorer\extensions\cmdmapping\{000007c6-17df-4438-92a4-de5537471ba3}"/>
</SW>
<SW NAME = "Favoriteman">
<REGVALUE VALUE = "Favoriteman software\microsoft\windows\counter"/>
<REGVALUEFOUND NAME = "software\microsoft\windows\counter"/>
</SW>
<SW NAME = "Favoriteman">
<REGVALUE VALUE = "Favoriteman software\microsoft\windows\server"/>
<REGVALUEFOUND NAME = "software\microsoft\windows\server"/>
</ScanningRegValues>
<ScanningRegValuesChanged>
</ScanningRegValuesChanged>
<FILE PATH = "Trojan/CWS Combo C:\WINDOWS\system32\MSrev21.dll"/>
<FILE PATH = "C:\WINDOWS\system32\MSrev21.dll"/>
<FILE PATH = "Trojan/CWS Combo C:\WINDOWS\system32\MSrev41.dll"/>
<FILE PATH = "C:\WINDOWS\system32\MSrev41.dll"/>
<FILE PATH = "Favoriteman C:\WINDOWS\system32\vg.dat"/>
<FILE PATH = "C:\WINDOWS\system32\vg.dat"/>
</Scanning>
<Information Message = "Starting to Quarantine 61 Items"/>
<Quarantines>
<QTFILE PATH = "C:\Program Files\XoftSpy\Quarantine\Quarantine14-11-2005-20-30-50.xpy" />
<INFO ACTION = "Added"/>
<INFO TIME = "14-11-2005-20-30-50"/>
<REGVALUE RES = "{000007c6-17df-4438-92a4-de5537471ba3} = dword:00002008
">
<REGVALUE RES = "counter = dword:00000001
">
<REGVALUE RES = "server = www.f1organizer.com
">
<QInformation Message = "Quarantining File Trojan/CWS Combo - C:\WINDOWS\system32\MSrev21.dll"/>
<QInformation Message = "Quarantining File Trojan/CWS Combo - C:\WINDOWS\system32\MSrev41.dll"/>
<QInformation Message = "Quarantining File Favoriteman - C:\WINDOWS\system32\vg.dat"/>
<QInformation Message = "Quarantining File 247realmedia cookie -
<Removal>
<SW NAME = "Lycos Sidesearch">
<REGVALUE NAME = "Software\Microsoft\Internet Explorer\extensions\cmdmapping\{000007c6-17df-4438-92a4-de5537471ba3}"/>
<REGVALUE RES = "Successfully Removed"/>
</SW>
<SW NAME = "Favoriteman">
<REGVALUE NAME = "software\microsoft\windows\counter"/>
<REGVALUE RES = "Successfully Removed"/>
<REGVALUE NAME = "software\microsoft\windows\server"/>
<REGVALUE RES = "Successfully Removed"/>
</SW>
<SW NAME = "Trojan/CWS Combo">
<FILE NAME = "C:\WINDOWS\system32\MSrev21.dll"/>
<FILE RES = "C:\WINDOWS\system32\MSrev21.dll Successfully ReMoved"/>
<FILE NAME = "C:\WINDOWS\system32\MSrev41.dll"/>
<FILE RES = "C:\WINDOWS\system32\MSrev41.dll Successfully ReMoved"/>
</SW>
<SW NAME = "Favoriteman">
<FILE NAME = "C:\WINDOWS\system32\vg.dat"/>
<FILE RES = "C:\WINDOWS\system32\vg.dat Successfully ReMoved"/>
Bookmark / Share this 
Post a reply, see related topics & more