NetOp Remote Control Name Server 8.00.2006047 serial key or number

1. , #1

   Virtumonde Infection

   I'm having a really tough time with this. I've used Spybot to try and remove, but it keeps showing up. Comodo scan comes up clean. I did a system restore, but that didn't seem to help.
   
   Now the computer runs so slow that I can only really use it in safe mode.
   
   I'd be very grateful for any assistance that could be offered.
   
   Thanks,
   Matt
   
   Logfile of Trend Micro HijackThis v (BETA)
   Scan saved at PM, on 2/10/
   Platform: Windows XP SP2 (WinNT )
   MSIE: Internet Explorer v SP2 ()
   Boot mode: Normal
   
   Running processes:
   C:\WINDOWS\System32\manicapital.com
   C:\WINDOWS\system32\manicapital.com
   C:\WINDOWS\system32\manicapital.com
   C:\WINDOWS\system32\manicapital.com
   C:\WINDOWS\system32\manicapital.com
   C:\WINDOWS\system32\manicapital.com
   C:\Program Files\COMODO\COMODO Internet Security\manicapital.com
   C:\WINDOWS\system32\manicapital.com
   C:\WINDOWS\system32\manicapital.com
   C:\WINDOWS\manicapital.com
   C:\WINDOWS\system32\manicapital.com
   C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsbexe
   C:\Program Files\Java\jre_07\bin\manicapital.com
   C:\WINDOWS\manicapital.com
   C:\PROGRA~1\VISION~1\ONETOU~manicapital.com
   C:\Program Files\Common Files\Apple\Mobile Device Support\bin\manicapital.com
   C:\Program Files\iTunes\manicapital.com
   C:\Program Files\COMODO\COMODO Internet Security\manicapital.com
   C:\Program Files\Symantec\pcAnywhere\awhostexe
   C:\Program Files\Veoh Networks\VeohWebPlayer\manicapital.com
   C:\Program Files\manicapital.com 3\program\manicapital.com
   C:\Program Files\Bonjour\manicapital.com
   C:\Program Files\manicapital.com 3\program\manicapital.com
   C:\WINDOWS\System32\manicapital.com
   C:\WINDOWS\system32\manicapital.com
   C:\Program Files\iPod\bin\manicapital.com
   C:\Program Files\Yahoo!\Messenger\ymsgr_manicapital.com
   C:\Program Files\Java\jre_07\bin\manicapital.com
   C:\Program Files\Mozilla Firefox\manicapital.com
   C:\WINDOWS\system32\manicapital.com
   C:\Program Files\TrendMicro\HiJackThis\manicapital.com
   
   R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = manicapital.com
   R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
   O2 - BHO: AcroIEHelperStub - {18DFC-E8ADAFAC2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\manicapital.com
   O2 - BHO: Spybot-S&D IE Protection - {FDDF} - C:\PROGRA~1\SPYBOT~1\manicapital.com
   O2 - BHO: SSVHelper Class - {BB-D6FC-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre_07\bin\manicapital.com
   O3 - Toolbar: The Weather Channel Toolbar - {2E5EE-6ACEAA35E43} - C:\WINDOWS\system32\manicapital.com
   O3 - Toolbar: Veoh Web Player Video Finder - {0FBBD3Df7a-A2EBBFC} - C:\Program Files\Veoh Networks\VeohWebPlayer\manicapital.com
   O4 - HKLM\..\Run: [PtiuPbmd] Rundllexe manicapital.com,SetWriteBack
   O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsbexe
   O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre_07\bin\manicapital.com"
   O4 - HKLM\..\Run: [SoundMan] manicapital.com
   O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader \Reader\Reader_manicapital.com"
   O4 - HKLM\..\Run: [OneTouch Monitor] C:\PROGRA~1\VISION~1\ONETOU~manicapital.com
   O4 - HKLM\..\Run: [WindowsServicesStartup] C:\DOCUME~1\Admin\LOCALS~1\Temp\manicapital.com 1
   O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\manicapital.com" -atboottime
   O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\manicapital.com"
   O4 - HKLM\..\Run: [AmazonGSDownloaderTray] C:\Program Files\Amazon\Amazon Games & Software Downloader\manicapital.com
   O4 - HKLM\..\Run: [Lhoyosobu] rundllexe "C:\WINDOWS\manicapital.com",Startup
   O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
   O4 - HKLM\..\Run: [COMODO Internet Security] "C:\Program Files\COMODO\COMODO Internet Security\manicapital.com" -h
   O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\manicapital.com" -autorun
   O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\manicapital.com
   O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\manicapital.com" -quiet
   O4 - HKCU\..\Run: [VeohPlugin] "C:\Program Files\Veoh Networks\VeohWebPlayer\manicapital.com"
   O4 - Startup: manicapital.com lnk = C:\Program Files\manicapital.com 3\program\manicapital.com
   O9 - Extra button: (no name) - {08B0E5CFCBCF-AAAC} - C:\Program Files\Java\jre_07\bin\manicapital.com
   O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5CFCBCF-AAAC} - C:\Program Files\Java\jre_07\bin\manicapital.com
   O9 - Extra button: The Weather Channel - {2E5EE-6ACEAA35E43} - (no file)
   O9 - Extra 'Tools' menuitem: The Weather Channel - {2E5EE-6ACEAA35E43} - (no file)
   O9 - Extra button: (no name) - {DFBAFC4-ACAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\manicapital.com
   O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFBAFC4-ACAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\manicapital.com
   O9 - Extra button: Messenger - {FB5FFd2-BB9EC04F} - C:\Program Files\Messenger\manicapital.com
   O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5FFd2-BB9EC04F} - C:\Program Files\Messenger\manicapital.com
   O17 - HKLM\System\CCS\Services\Tcpip\..\{A-9EAAED6B3D77}: NameServer =
   O20 - AppInit_DLLs: C:\WINDOWS\system32\guarddll
   O22 - SharedTaskScheduler: Browseui preloader - {C2-A8BAD1-B96BA0CE1} - C:\WINDOWS\System32\manicapital.com
   O22 - SharedTaskScheduler: Component Categories cache daemon - {8CEF-2Bd2-BEC} - C:\WINDOWS\System32\manicapital.com
   O23 - Service: Amazon Download Agent - manicapital.com - C:\Program Files\Amazon\Amazon Games & Software Downloader\manicapital.com
   O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\manicapital.com
   O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\manicapital.com
   O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\manicapital.com
   O23 - Service: pcAnywhere Host Service (awhost32) - Symantec Corporation - C:\Program Files\Symantec\pcAnywhere\awhostexe
   O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\manicapital.com
   O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\COMODO Internet Security\manicapital.com
   O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\manicapital.com
   O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\manicapital.com
   O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\manicapital.com
   O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\manicapital.com
   O23 - Service: NetOp Helper ver. () (NetOp Host for NT Service) - Danware Data A/S - C:\Program Files\Danware Data\NetOp Remote Control\Host\manicapital.com
   
   --
   End of file - bytes

   

   ---

2. , #2
   Security Expert: Emeritus

   ---

   Join Date

   Oct

   Location

   Finland

   Posts

   29,

   

   Hi thesaint
   
   Please post spybot report next

   Microsoft MVP Consumer Security
   
   Member of ASAP and UNITE since

   

   ---

3. , #3

   

   Hi Shaba,
   
   Thanks a lot for helping me out on this.
   
   This is the first scan that has come up empty for threats, but I ran this in safe mode with networking. I'm not sure if that has something to do with the clean scan though.
   
   Here's the log:
   
   
   Search result list
   Congratulations!: No immediate threats were found. (Status)
   
   
   
   Spybot - Search & Destroy version: (build: )
   
   manicapital.com ()
   manicapital.com ()
   manicapital.com ()
   manicapital.com ()
   manicapital.com ()
   manicapital.com ()
   uninsexe ()
   manicapital.com ()
   manicapital.com ()
   manicapital.com ()
   DelZipdll ()
   manicapital.com ()
   manicapital.com
   manicapital.com ()
   manicapital.com ()
   Includes\manicapital.com (*)
   Includes\manicapital.com (*)
   Includes\manicapital.com (*)
   Includes\manicapital.com (*)
   Includes\manicapital.com (*)
   Includes\manicapital.com (*)
   Includes\manicapital.com (*)
   Includes\manicapital.com (*)
   Includes\manicapital.com (*)
   Includes\manicapital.com (*)
   Includes\manicapital.com (*)
   Includes\manicapital.com (*)
   Includes\manicapital.com (*)
   Includes\manicapital.com (*)
   Includes\manicapital.com (*)
   Includes\manicapital.com (*)
   Includes\manicapital.com (*)
   Includes\manicapital.com (*)
   Includes\manicapital.com (*)
   Includes\manicapital.com (*)
   Includes\manicapital.com (*)
   Includes\manicapital.com (*)
   Includes\manicapital.com
   Includes\manicapital.com (*)
   Includes\manicapital.com (*)
   Plugins\manicapital.com
   Plugins\manicapital.com
   Plugins\manicapital.com
   Plugins\manicapital.com
   
   
   
   System information
   Windows XP (Build: ) Service Pack 2 ()
   / Windows Media Player Security Update for Windows Media Player 10 (KB)
   / Windows Media Player Security Update for Windows Media Player 10 (KB)
   / Windows XP / SP2: Windows XP Service Pack 2
   / Windows XP / SP3: Windows XP Hotfix - KB
   / Windows XP / SP3: Windows XP Hotfix - KB
   / Windows XP / SP3: Windows XP Hotfix - KB
   / Windows XP / SP3: Windows XP Hotfix - KB
   / Windows XP / SP3: Windows XP Hotfix - KB
   / Windows XP / SP3: Windows XP Hotfix - KB
   / Windows XP / SP3: Windows XP Hotfix - KB
   / Windows XP / SP3: Windows XP Hotfix - KB
   / Windows XP / SP3: Windows XP Hotfix - KB
   / Windows XP / SP3: Windows XP Hotfix - KB
   / Windows XP / SP3: Security Update for Windows XP (KB)
   / Windows XP / SP3: Windows XP Hotfix - KB
   / Windows XP / SP3: Windows XP Hotfix - KB
   / Windows XP / SP3: Security Update for Windows XP (KB)
   / Windows XP / SP3: Security Update for Windows XP (KB)
   / Windows XP / SP3: Windows Installer (KB)
   / Windows XP / SP3: Update for Windows XP (KB)
   / Windows XP / SP3: Security Update for Windows XP (KB)
   / Windows XP / SP3: Security Update for Windows XP (KB)
   / Windows XP / SP3: Security Update for Windows XP (KB)
   / Windows XP / SP3: Security Update for Windows XP (KB)
   / Windows XP / SP3: Security Update for Windows XP (KB)
   / Windows XP / SP3: Security Update for Windows XP (KB)
   / Windows XP / SP3: Update for Windows XP (KB)
   / Windows XP / SP3: Security Update for Windows XP (KB)
   / Windows XP / SP3: Security Update for Windows XP (KB)
   / Windows XP / SP3: Security Update for Windows XP (KB)
   / Windows XP / SP3: Update for Windows XP (KB)
   / Windows XP / SP3: Security Update for Windows XP (KB)
   / Windows XP / SP3: Security Update for Windows XP (KB)
   / Windows XP / SP3: Security Update for Windows XP (KB)
   / Windows XP / SP3: Security Update for Windows XP (KB)
   / Windows XP / SP3: Security Update for Windows XP (KB)
   / Windows XP / SP3: Security Update for Windows XP (KB)
   / Windows XP / SP3: Security Update for Windows XP (KB)
   / Windows XP / SP3: Security Update for Windows XP (KB)
   / Windows XP / SP3: Security Update for Windows XP (KB)
   / Windows XP / SP3: Security Update for Windows XP (KB)
   / Windows XP / SP3: Update for Windows XP (KB)
   / Windows XP / SP3: Update for Windows XP (KB)
   / Windows XP / SP3: Security Update for Windows XP (KB)
   / Windows XP / SP3: Security Update for Windows XP (KB)
   / Windows XP / SP3: Security Update for Windows XP (KB)
   / Windows XP / SP3: Security Update for Windows XP (KB)
   / Windows XP / SP3: Security Update for Windows XP (KB)
   / Windows XP / SP3: Security Update for Windows XP (KB)
   / Windows XP / SP3: Security Update for Windows XP (KB)
   / Windows XP / SP3: Security Update for Windows XP (KB)
   / Windows XP / SP3: Security Update for Windows XP (KB)
   / Windows XP / SP3: Update for Windows XP (KB)
   / Windows XP / SP3: Security Update for Windows XP (KB)
   / Windows XP / SP3: Security Update for Windows XP (KB)
   / Windows XP / SP3: Security Update for Windows XP (KB)
   / Windows XP / SP3: Security Update for Windows XP (KB)
   
   
   Startup entries list
   Located: HK_LM:Run, Adobe Reader Speed Launcher
   command: "C:\Program Files\Adobe\Reader \Reader\Reader_manicapital.com"
   file: C:\Program Files\Adobe\Reader \Reader\Reader_manicapital.com
   size:
   MD5: 69B16C7BBA5CFC05BFC73
   
   Located: HK_LM:Run, COMODO Internet Security
   command: "C:\Program Files\COMODO\COMODO Internet Security\manicapital.com" -h
   file: C:\Program Files\COMODO\COMODO Internet Security\manicapital.com
   size:
   MD5: 6B2EC6A02B6CC3DAE62BD
   
   Located: HK_LM:Run, HPDJ Taskbar Utility
   command: C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsbexe
   file: C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsbexe
   size:
   MD5: E2DA2DA04DBAF4D9E44AA24B00F2ABCA
   
   Located: HK_LM:Run, iTunesHelper
   command: "C:\Program Files\iTunes\manicapital.com"
   file: C:\Program Files\iTunes\manicapital.com
   size:
   MD5: 9D4FF8D3A13F2FEADB66C62FE5D0
   
   Located: HK_LM:Run, KernelFaultCheck
   command: %systemroot%\system32\dumprep 0 -k
   file: C:\windows\system32\dumprep 0 -k
   size: 0
   MD5: D41D8CD98F00BEECFE
   Warning: if the file is actually larger than 0 bytes,
   the checksum could not be properly calculated!
   
   Located: HK_LM:Run, MSConfig
   command: C:\WINDOWS\PCHealth\HelpCtr\Binaries\manicapital.com /auto
   file: C:\WINDOWS\PCHealth\HelpCtr\Binaries\manicapital.com
   size:
   MD5: 4FDFA7B98B7DE
   
   Located: HK_LM:Run, OneTouch Monitor
   command: C:\PROGRA~1\VISION~1\ONETOU~manicapital.com
   file: C:\PROGRA~1\VISION~1\ONETOU~manicapital.com
   size:
   MD5: EB0EE1AE08ACCA9BA21DD55
   
   Located: HK_LM:Run, PtiuPbmd
   command: Rundllexe manicapital.com,SetWriteBack
   file: C:\windows\system32\manicapital.com
   size:
   MD5: AB29E7A6BF1AFFE0BD9C85
   
   Located: HK_LM:Run, QuickTime Task
   command: "C:\Program Files\QuickTime\manicapital.com" -atboottime
   file: C:\Program Files\QuickTime\manicapital.com
   size:
   MD5: FABAD2BFDD8CCEBFAFAF
   
   Located: HK_LM:Run, SoundMan
   command: manicapital.com
   file: C:\windows\manicapital.com
   size:
   MD5: DF88FD13ACC
   
   Located: HK_LM:Run, SunJavaUpdateSched
   command: "C:\Program Files\Java\jre_07\bin\manicapital.com"
   file: C:\Program Files\Java\jre_07\bin\manicapital.com
   size:
   MD5: 6AB4CFBD36DCCD97
   
   Located: HK_LM:RunOnce, Malwarebytes' Anti-Malware
   command: C:\Program Files\Malwarebytes' Anti-Malware\manicapital.com /install /silent
   file: C:\Program Files\Malwarebytes' Anti-Malware\manicapital.com
   size:
   MD5: 2F45DACAA9D0AD52FF9
   
   Located: HK_CU:Run, DAEMON Tools Lite
   where: S
   command: "C:\Program Files\DAEMON Tools Lite\manicapital.com" -autorun
   file: C:\Program Files\DAEMON Tools Lite\manicapital.com
   size:
   MD5: 2ACCD0D8AA59E4AAD8EFFEEF
   
   Located: HK_CU:Run, DW6
   where: S
   command:
   file:
   size: 0
   MD5: D41D8CD98F00BEECFE
   Warning: if the file is actually larger than 0 bytes,
   the checksum could not be properly calculated!
   
   Located: HK_CU:Run, SpybotSD TeaTimer
   where: S
   command: C:\Program Files\Spybot - Search & Destroy\manicapital.com
   file: C:\Program Files\Spybot - Search & Destroy\manicapital.com
   size: 0
   MD5: D41D8CD98F00BEECFE
   Warning: if the file is actually larger than 0 bytes,
   the checksum could not be properly calculated!
   
   Located: HK_CU:Run, VeohPlugin
   where: S
   command: "C:\Program Files\Veoh Networks\VeohWebPlayer\manicapital.com"
   file: C:\Program Files\Veoh Networks\VeohWebPlayer\manicapital.com
   size:
   MD5: BAD4CFCEE6
   
   Located: Startup (user), manicapital.com lnk
   where: C:\Documents and Settings\Admin\Start Menu\Programs\Startup
   command: C:\Program Files\manicapital.com 3\program\manicapital.com
   file: C:\Program Files\manicapital.com 3\program\manicapital.com
   size:
   MD5: BE0CED3CC47DA
   
   Located: WinLogon, AtiExtEvent
   command: manicapital.com
   file: manicapital.com
   size: 0
   MD5: D41D8CD98F00BEECFE
   Warning: if the file is actually larger than 0 bytes,
   the checksum could not be properly calculated!
   
   Located: WinLogon, crypt32chain
   command: cryptdll
   file: cryptdll
   size: 0
   MD5: D41D8CD98F00BEECFE
   Warning: if the file is actually larger than 0 bytes,
   the checksum could not be properly calculated!
   
   Located: WinLogon, cryptnet
   command: manicapital.com
   file: manicapital.com
   size: 0
   MD5: D41D8CD98F00BEECFE
   Warning: if the file is actually larger than 0 bytes,
   the checksum could not be properly calculated!
   
   Located: WinLogon, cscdll
   command: manicapital.com
   file: manicapital.com
   size: 0
   MD5: D41D8CD98F00BEECFE
   Warning: if the file is actually larger than 0 bytes,
   the checksum could not be properly calculated!
   
   Located: WinLogon, PCANotify
   command: manicapital.com
   file: manicapital.com
   size: 0
   MD5: D41D8CD98F00BEECFE
   Warning: if the file is actually larger than 0 bytes,
   the checksum could not be properly calculated!
   
   Located: WinLogon, ScCertProp
   command: manicapital.com
   file: manicapital.com
   size: 0
   MD5: D41D8CD98F00BEECFE
   Warning: if the file is actually larger than 0 bytes,
   the checksum could not be properly calculated!
   
   Located: WinLogon, Schedule
   command: manicapital.com
   file: manicapital.com
   size: 0
   MD5: D41D8CD98F00BEECFE
   Warning: if the file is actually larger than 0 bytes,
   the checksum could not be properly calculated!
   
   Located: WinLogon, sclgntfy
   command: manicapital.com
   file: manicapital.com
   size: 0
   MD5: D41D8CD98F00BEECFE
   Warning: if the file is actually larger than 0 bytes,
   the checksum could not be properly calculated!
   
   Located: WinLogon, SensLogn
   command: manicapital.com
   file: manicapital.com
   size: 0
   MD5: D41D8CD98F00BEECFE
   Warning: if the file is actually larger than 0 bytes,
   the checksum could not be properly calculated!
   
   Located: WinLogon, termsrv
   command: manicapital.com
   file: manicapital.com
   size: 0
   MD5: D41D8CD98F00BEECFE
   Warning: if the file is actually larger than 0 bytes,
   the checksum could not be properly calculated!
   
   Located: WinLogon, wlballoon
   command: manicapital.com
   file: manicapital.com
   size: 0
   MD5: D41D8CD98F00BEECFE
   Warning: if the file is actually larger than 0 bytes,
   the checksum could not be properly calculated!
   
   
   
   Browser helper object list
   {18DFC-E8ADAFAC2EBDC3} (AcroIEHelperStub)
   location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
   BHO name: AcroIEHelperStub
   CLSID name: Adobe PDF Link Helper
   Path: C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\
   Long name: manicapital.com
   Short name: ACROIE~manicapital.com
   Date (created): 6/11/ PM
   Date (last access): 2/15/ PM
   Date (last write): 6/11/ PM
   Filesize:
   Attributes: archive
   MD5: E96CBBA0EAFCE
   CRC E5D
   Version:
   
   {FDDF} (Spybot-S&D IE Protection)
   location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
   BHO name:
   CLSID name: Spybot-S&D IE Protection
   description: Spybot-S&D IE Browser plugin
   classification: Legitimate
   known filename: manicapital.com
   info link: manicapital.com
   info source: Patrick M. Kolla
   Path: C:\PROGRA~1\SPYBOT~1\
   Long name: manicapital.com
   Short name:
   Date (created): 3/16/ PM
   Date (last access): 2/15/ PM
   Date (last write): 1/26/ PM
   Filesize:
   Attributes: archive
   MD5: C2F6DCCDFA0ADDE62AFAC
   CRC 5BA
   Version:
   
   {BB-D6FC-B6EB-D4DAF1D92D43} (SSVHelper Class)
   location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
   BHO name:
   CLSID name: SSVHelper Class
   Path: C:\Program Files\Java\jre_07\bin\
   Long name: manicapital.com
   Short name:
   Date (created): 11/24/ PM
   Date (last access): 2/15/ PM
   Date (last write): 6/10/ AM
   Filesize:
   Attributes: archive
   MD5: FDA1CBD69A6ABABC
   CRC 38AC9EE2
   Version:
   
   
   
   ActiveX list
   {8AD9CED1-B3EFD93} (Java Runtime Environment )
   DPF name: Java Runtime Environment
   CLSID name: Java Plug-in _07
   Installer:
   Codebase: manicapital.com
   description: Sun Java
   classification: Legitimate
   known filename: %PROGRAM FILES%\JabaSoft\JRE\*\Bin\npjavadll
   info link:
   info source: Patrick M. Kolla
   Path: C:\Program Files\Java\jre_07\bin\
   Long name: npjpi_dll
   Short name: NPJPI1~manicapital.com
   Date (created): 6/10/ AM
   Date (last access): 2/12/ PM
   Date (last write): 6/10/ AM
   Filesize:
   Attributes: archive
   MD5: 7C83AEAC9D5DB8
   CRC C2A88
   Version:
   
   {CAFEEFACABCDEFFEDCBA} (Java Runtime Environment )
   DPF name: Java Runtime Environment
   CLSID name: Java Plug-in _03
   Installer:
   Codebase: manicapital.com
   description:
   classification: Legitimate
   known filename: NPJPI_dll
   info link:
   info source: Safer Networking Ltd.
   Path: C:\Program Files\Java\jre_03\bin\
   Long name: NPJPI_dll
   Short name: NPJPI1~manicapital.com
   Date (created): 4/13/ AM
   Date (last access): 2/12/ PM
   Date (last write): 4/13/ AM
   Filesize:
   Attributes: archive
   MD5: 13FCA03EBCA6E1F8CCD1FE
   CRC CF
   Version:
   
   {CAFEEFACABCDEFFEDCBA} (Java Runtime Environment )
   DPF name: Java Runtime Environment
   CLSID name: Java Plug-in _07
   Installer:
   Codebase: manicapital.com
   Path: C:\Program Files\Java\jre_07\bin\
   Long name: npjpi_dll
   Short name: NPJPI1~manicapital.com
   Date (created): 6/10/ AM
   Date (last access): 2/15/ PM
   Date (last write): 6/10/ AM
   Filesize:
   Attributes: archive
   MD5: 7C83AEAC9D5DB8
   CRC C2A88
   Version:
   
   {D27CDB6E-AE6DCFB} (Shockwave Flash Object)
   DPF name:
   CLSID name: Shockwave Flash Object
   Installer: C:\WINDOWS\Downloaded Program Files\manicapital.com
   Codebase: manicapital.com
   description: Macromedia Shockwave Flash Player
   classification: Legitimate
   known filename:
   info link:
   info source: Patrick M. Kolla
   Path: C:\WINDOWS\system32\Macromed\Flash\
   Long name: manicapital.com
   Short name:
   Date (created): 2/2/ PM
   Date (last access): 2/12/ PM
   Date (last write): 2/2/ PM
   Filesize:
   Attributes: readonly archive
   MD5: 8AFCED5AB60B7C52D7FDC
   CRC 0FBC13F3
   Version:
   
   
   
   Process list
   PID: 0 ( 0) [System]
   PID: ( 4) \SystemRoot\System32\manicapital.com
   size:
   PID: ( ) \??\C:\windows\system32\manicapital.com
   size:
   PID: ( ) \??\C:\windows\system32\manicapital.com
   size:
   PID: ( ) C:\windows\system32\manicapital.com
   size:
   MD5: C6CE6EEC82FDBB3BB50ED4
   PID: ( ) C:\windows\system32\manicapital.com
   size:
   MD5: F9B82F4D55CEBFD75D2
   PID: ( ) C:\windows\system32\manicapital.com
   size:
   MD5: 8FAE4EDAAABC0ADE
   PID: ( ) C:\windows\system32\manicapital.com
   size:
   MD5: 8FAE4EDAAABC0ADE
   PID: ( ) C:\windows\system32\manicapital.com
   size:
   MD5: 8FAE4EDAAABC0ADE
   PID: ( ) C:\windows\System32\manicapital.com
   size:
   MD5: 8FAE4EDAAABC0ADE
   PID: ( ) C:\windows\System32\manicapital.com
   size:
   MD5: 8FAE4EDAAABC0ADE
   PID: ( ) C:\windows\manicapital.com
   size:
   MD5: AAEBE64
   PID: ( ) C:\Program Files\Spybot - Search & Destroy\manicapital.com
   size:
   MD5: C2FCA5BCFDFBA8D89
   PID: ( ) C:\Program Files\Mozilla Firefox\manicapital.com
   size:
   MD5: B4A8CA9A1EEEE32A4DC5DAED3F
   PID: () C:\windows\manicapital.com
   size:
   MD5: AAE7C1FFADAFBFAC34B34
   PID: 4 ( 0) System
   
   
   Browser start & search pages list
   Spybot - Search & Destroy browser pages report, 2/15/ PM
   
   HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Local Page
   C:\WINDOWS\system32\manicapital.com
   HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Search Page
   manicapital.com&ar=iesearch
   HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page
   manicapital.com
   HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Local Page
   %SystemRoot%\system32\manicapital.com
   HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Search Page
   manicapital.com&ar=iesearch
   HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Start Page
   manicapital.com?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
   HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Default_Page_URL
   manicapital.com=6&ar=msnhome
   HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Default_Search_URL
   manicapital.com&ar=iesearch
   HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search\SearchAssistant
   manicapital.com{SUB_RFC}/srchasst/manicapital.com
   HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search\CustomizeSearch
   manicapital.com{SUB_RFC}/srchasst/manicapital.com
   
   
   Winsock Layered Service Provider list
   Protocol 0: MSAFD Tcpip [TCP/IP]
   GUID: {E70F1AA0-AB8BCF-8CAF48A}
   Filename: %SystemRoot%\system32\manicapital.com
   Description: Microsoft Windows NT/2k/XP IP protocol
   DB filename: %SystemRoot%\system32\manicapital.com
   DB protocol: MSAFD Tcpip[*]
   
   Protocol 1: MSAFD Tcpip [UDP/IP]
   GUID: {E70F1AA0-AB8BCF-8CAF48A}
   Filename: %SystemRoot%\system32\manicapital.com
   Description: Microsoft Windows NT/2k/XP IP protocol
   DB filename: %SystemRoot%\system32\manicapital.com
   DB protocol: MSAFD Tcpip[*]
   
   Protocol 2: MSAFD Tcpip [RAW/IP]
   GUID: {E70F1AA0-AB8BCF-8CAF48A}
   Filename: %SystemRoot%\system32\manicapital.com
   Description: Microsoft Windows NT/2k/XP IP protocol
   DB filename: %SystemRoot%\system32\manicapital.com
   DB protocol: MSAFD Tcpip[*]
   
   Protocol 3: RSVP UDP Service Provider
   GUID: {9D60A9EAD0-BDCE69A}
   Filename: %SystemRoot%\system32\manicapital.com
   Description: Microsoft Windows NT/2k/XP RVSP
   DB filename: %SystemRoot%\system32\manicapital.com
   DB protocol: RSVP * Service Provider
   
   Protocol 4: RSVP TCP Service Provider
   GUID: {9D60A9EAD0-BDCE69A}
   Filename: %SystemRoot%\system32\manicapital.com
   Description: Microsoft Windows NT/2k/XP RVSP
   DB filename: %SystemRoot%\system32\manicapital.com
   DB protocol: RSVP * Service Provider
   
   Protocol 5: MSAFD NetBIOS [\Device\NetBT_Tcpip_{17DCBB6EDA-9B5D-1DFDBAB0BE91}] SEQPACKET 4
   GUID: {8D5FCCFCF48A}
   Filename: %SystemRoot%\system32\manicapital.com
   Description: Microsoft Windows NT/2k/XP NetBios protocol
   DB filename: %SystemRoot%\system32\manicapital.com
   DB protocol: MSAFD NetBIOS *
   
   Protocol 6: MSAFD NetBIOS [\Device\NetBT_Tcpip_{17DCBB6EDA-9B5D-1DFDBAB0BE91}] DATAGRAM 4
   GUID: {8D5FCCFCF48A}
   Filename: %SystemRoot%\system32\manicapital.com
   Description: Microsoft Windows NT/2k/XP NetBios protocol
   DB filename: %SystemRoot%\system32\manicapital.com
   DB protocol: MSAFD NetBIOS *
   
   Protocol 7: MSAFD NetBIOS [\Device\NetBT_Tcpip_{A-9EAAED6B3D77}] SEQPACKET 3
   GUID: {8D5FCCFCF48A}
   Filename: %SystemRoot%\system32\manicapital.com
   Description: Microsoft Windows NT/2k/XP NetBios protocol
   DB filename: %SystemRoot%\system32\manicapital.com
   DB protocol: MSAFD NetBIOS *
   
   Protocol 8: MSAFD NetBIOS [\Device\NetBT_Tcpip_{A-9EAAED6B3D77}] DATAGRAM 3
   GUID: {8D5FCCFCF48A}
   Filename: %SystemRoot%\system32\manicapital.com
   Description: Microsoft Windows NT/2k/XP NetBios protocol
   DB filename: %SystemRoot%\system32\manicapital.com
   DB protocol: MSAFD NetBIOS *
   
   Protocol 9: MSAFD NetBIOS [\Device\NetBT_Tcpip_{D9DAFEA2F7-DE4AF}] SEQPACKET 0
   GUID: {8D5FCCFCF48A}
   Filename: %SystemRoot%\system32\manicapital.com
   Description: Microsoft Windows NT/2k/XP NetBios protocol
   DB filename: %SystemRoot%\system32\manicapital.com
   DB protocol: MSAFD NetBIOS *
   
   Protocol MSAFD NetBIOS [\Device\NetBT_Tcpip_{D9DAFEA2F7-DE4AF}] DATAGRAM 0
   GUID: {8D5FCCFCF48A}
   Filename: %SystemRoot%\system32\manicapital.com
   Description: Microsoft Windows NT/2k/XP NetBios protocol
   DB filename: %SystemRoot%\system32\manicapital.com
   DB protocol: MSAFD NetBIOS *
   
   Protocol MSAFD NetBIOS [\Device\NetBT_Tcpip_{3ECCFDEFCD}] SEQPACKET 1
   GUID: {8D5FCCFCF48A}
   Filename: %SystemRoot%\system32\manicapital.com
   Description: Microsoft Windows NT/2k/XP NetBios protocol
   DB filename: %SystemRoot%\system32\manicapital.com
   DB protocol: MSAFD NetBIOS *
   
   Protocol MSAFD NetBIOS [\Device\NetBT_Tcpip_{3ECCFDEFCD}] DATAGRAM 1
   GUID: {8D5FCCFCF48A}
   Filename: %SystemRoot%\system32\manicapital.com
   Description: Microsoft Windows NT/2k/XP NetBios protocol
   DB filename: %SystemRoot%\system32\manicapital.com
   DB protocol: MSAFD NetBIOS *
   
   Protocol MSAFD NetBIOS [\Device\NetBT_Tcpip_{08DABEABBDAA-CAC1C9CDB}] SEQPACKET 2
   GUID: {8D5FCCFCF48A}
   Filename: %SystemRoot%\system32\manicapital.com
   Description: Microsoft Windows NT/2k/XP NetBios protocol
   DB filename: %SystemRoot%\system32\manicapital.com
   DB protocol: MSAFD NetBIOS *
   
   Protocol MSAFD NetBIOS [\Device\NetBT_Tcpip_{08DABEABBDAA-CAC1C9CDB}] DATAGRAM 2
   GUID: {8D5FCCFCF48A}
   Filename: %SystemRoot%\system32\manicapital.com
   Description: Microsoft Windows NT/2k/XP NetBios protocol
   DB filename: %SystemRoot%\system32\manicapital.com
   DB protocol: MSAFD NetBIOS *
   
   Namespace Provider 0: Tcpip
   GUID: {DE9ECF-AE5AAA00AB}
   Filename: %SystemRoot%\System32\manicapital.com
   Description: Microsoft Windows NT/2k/XP TCP/IP name space provider
   DB filename: %SystemRoot%\system32\manicapital.com
   DB protocol: TCP/IP
   
   Namespace Provider 1: NTDS
   GUID: {3BEE-ECF-AC04FD8D4AC}
   Filename: %SystemRoot%\System32\manicapital.com
   Description: Microsoft Windows NT/2k/XP name space provider
   DB filename: %SystemRoot%\system32\manicapital.com
   DB protocol: NTDS
   
   Namespace Provider 2: Network Location Awareness (NLA) Namespace
   GUID: {A-3BAAA6-BAAE0BD71FDD83}
   Filename: %SystemRoot%\System32\manicapital.com
   Description: Microsoft Windows NT/2k/XP name space provider
   DB filename: %SystemRoot%\system32\manicapital.com
   DB protocol: NLA-Namespace
   
   Namespace Provider 3: mdnsNSP
   GUID: {BE6EB-4AE5C}
   Filename: C:\Program Files\Bonjour\manicapital.com
   Description: Apple Rendezvous protocol
   DB filename: %ProgramFiles%\Rendezvous\bin\manicapital.com
   DB protocol: mdnsNSP

   

   ---

4. , #4
   Security Expert: Emeritus

   ---

   Join Date

   Oct

   Location

   Finland

   Posts

   29,

   

   Download at your desktop DDS from one of the links below:
   
   Link 1
   Link 2
   

   • Double click the tool to run it.
   • A black Screen will open, just read the contents and do nothing.
   • When the tool finish it will open 2 reports.
   • Copy/paste both reports back here and remove DDS from your desktop.

   Microsoft MVP Consumer Security
   
   Member of ASAP and UNITE since

   

   ---

5. , #5

   

   Here is manicapital.com:
   
   
   DDS (Ver_) - NTFSx86 NETWORK
   Run by Admin at on Tue 02/16/
   Internet Explorer:
   Microsoft Windows XP Professional [GMT ]
   
   AV: COMODO Antivirus *On-access scanning enabled* (Updated) {AFef7-AFC5-F6E02AB}
   FW: COMODO Firewall *enabled* {AFef6-AFC5-F6E02AB}
   
   ============== Running Processes ===============
   
   C:\windows\system32\svchost -k DcomLaunch
   manicapital.com
   C:\windows\system32\manicapital.com -k netsvcs
   manicapital.com
   manicapital.com
   C:\windows\manicapital.com
   C:\Documents and Settings\Admin\Desktop\manicapital.com
   
   ============== Pseudo HJT Report ===============
   
   uStart Page = hxxp://manicapital.com
   uInternet Settings,ProxyOverride = *.local
   BHO: Adobe PDF Link Helper: {18dfc-e8adafac2ebdc3} - c:\program files\common files\adobe\acrobat\activex\manicapital.com
   BHO: Spybot-S&D IE Protection: {fddf} - c:\progra~1\spybot~1\manicapital.com
   BHO: SSVHelper Class: {bb-d6fc-b6eb-d4daf1d92d43} - c:\program files\java\jre_07\bin\manicapital.com
   TB: Veoh Web Player Video Finder: {0fbbd3df7a-a2ebbfc} - c:\program files\veoh networks\veohwebplayer\manicapital.com
   TB: {E67C74F4-A00A-4F2C-9FEC-FD9DCA67F} - No File
   EB: {ab-ac2aa} - No File
   uRun: [DAEMON Tools Lite] "c:\program files\daemon tools lite\manicapital.com" -autorun
   uRun: [DW6]
   uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\manicapital.com
   uRun: [VeohPlugin] "c:\program files\veoh networks\veohwebplayer\manicapital.com"
   mRun: [PtiuPbmd] Rundllexe manicapital.com,SetWriteBack
   mRun: [HPDJ Taskbar Utility] c:\windows\system32\spool\drivers\w32x86\3\hpztsbexe
   mRun: [SunJavaUpdateSched] "c:\program files\java\jre_07\bin\manicapital.com"
   mRun: [SoundMan] manicapital.com
   mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader \reader\Reader_manicapital.com"
   mRun: [OneTouch Monitor] c:\progra~1\vision~1\ONETOU~manicapital.com
   mRun: [QuickTime Task] "c:\program files\quicktime\manicapital.com" -atboottime
   mRun: [iTunesHelper] "c:\program files\itunes\manicapital.com"
   mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
   mRun: [COMODO Internet Security] "c:\program files\comodo\comodo internet security\manicapital.com" -h
   mRun: [MSConfig] c:\windows\pchealth\helpctr\binaries\manicapital.com /auto
   mRunOnce: [Malwarebytes' Anti-Malware] c:\program files\malwarebytes' anti-malware\manicapital.com /install /silent
   StartupFolder: c:\docume~1\admin\startm~1\programs\startup\openof~manicapital.com - c:\program files\manicapital.com 3\program\manicapital.com
   IE: {FB5FFd2-BB9EC04F} - c:\program files\messenger\manicapital.com
   IE: {08B0E5CFCBCF-AAAC} - {CAFEEFACABCDEFFEDCBC} - c:\program files\java\jre_07\bin\manicapital.com
   IE: {DFBAFC4-ACAB36FD2A2} - {FDDF} - c:\progra~1\spybot~1\manicapital.com
   DPF: {8AD9CED1-B3EFD93} - hxxp://manicapital.com
   DPF: {CAFEEFACABCDEFFEDCBA} - hxxp://manicapital.com
   DPF: {CAFEEFACABCDEFFEDCBA} - hxxp://manicapital.com
   DPF: {D27CDB6E-AE6DCFB} - hxxp://manicapital.com
   TCP: {A-9EAAED6B3D77} =
   Notify: AtiExtEvent - manicapital.com
   Notify: PCANotify - manicapital.com
   AppInit_DLLs: c:\windows\system32\guarddll
   LSA: Notification Packages = scecli manicapital.com
   Hosts: manicapital.com
   
   ================= FIREFOX ===================
   
   FF - ProfilePath - c:\docume~1\admin\applic~1\mozilla\firefox\profiles\manicapital.comt\
   FF - manicapital.com: manicapital.comge - hxxp://manicapital.com
   FF - component: c:\documents and settings\admin\application data\mozilla\firefox\profiles\manicapital.comt\extensions\{ca9c-de6dadec}\components\manicapital.com
   FF - plugin: c:\documents and settings\admin\application data\move networks\plugins\npqmpdll
   FF - plugin: c:\documents and settings\admin\application data\mozilla\firefox\profiles\manicapital.comt\extensions\{ee8ff-4fbac9bfa7}\plugins\np_manicapital.com
   FF - plugin: c:\documents and settings\admin\application data\mozilla\firefox\profiles\manicapital.comt\extensions\player@manicapital.com\plugins\manicapital.com
   FF - plugin: c:\program files\veoh networks\veohwebplayer\manicapital.com
   FF - plugin: c:\program files\veoh networks\veohwebplayer\manicapital.com
   FF - HiddenExtension: XULRunner: {CFECFCB2} - c:\documents and settings\admin\local settings\application data\{CFECFCB2}
   FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFACABCDEFFEDCBA}
   
   FIREFOX POLICIES
   c:\program files\mozilla firefox\greprefs\manicapital.com - pref("manicapital.com_seed_sha", true);
   
   ============= SERVICES / DRIVERS ===============
   
   R0 abus;abus;c:\windows\system32\drivers\manicapital.com [ ]
   R0 ascsi;ascsi;c:\windows\system32\drivers\manicapital.com [ ]
   R0 dontgo;Promise Removable Disk Control Driver;c:\windows\system32\drivers\manicapital.com [ ]
   R0 ulsata2;ulsata2;c:\windows\system32\drivers\manicapital.com [ ]
   R1 AW_HOST;AW_HOST;c:\windows\system32\drivers\AW_manicapital.com [ ]
   R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\drivers\manicapital.com [ ]
   S1 awlegacy;awlegacy;c:\windows\system32\drivers\manicapital.com [ ]
   S1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\drivers\manicapital.com [ ]
   S1 NHostNT1;NetOp Driver 1 ver. ();c:\windows\system32\drivers\manicapital.com [ ]
   S2 awhost32;pcAnywhere Host Service;c:\program files\symantec\pcanywhere\awhostexe [ ]
   S2 cmdAgent;COMODO Internet Security Helper Service;c:\program files\comodo\comodo internet security\manicapital.com [ ]
   S2 NetOp Host for NT Service;NetOp Helper ver. ();c:\program files\danware data\netop remote control\host\manicapital.com [ ]
   S2 ppsio2;PPDevice;c:\windows\system32\drivers\manicapital.com [ ]
   S3 NHOSTNT3;NetOp Driver 3 ver. () (NHOSTNT3);c:\windows\system32\drivers\manicapital.com [ ]
   
   =============== Created Last 30 ================
   
   a-w- c:\windows\manicapital.com
   a-w- c:\windows\system32\drivers\manicapital.com
   a-w- c:\windows\system32\drivers\manicapital.com
   0 dw- c:\program files\Malwarebytes' Anti-Malware
   a-w- c:\windows\system32\drivers\manicapital.com
   0 dw- c:\program files\CCleaner
   a-w- c:\windows\system32\drivers\manicapital.com
   0 dw- c:\docume~1\admin\applic~1\Malwarebytes
   0 dw- c:\docume~1\alluse~1\applic~1\Malwarebytes
   0 dw- c:\program files\TrendMicro
   a-w- c:\windows\system32\guarddll
   0 dw- c:\docume~1\alluse~1\applic~1\Comodo
   a-w- c:\windows\system32\drivers\manicapital.com
   a-w- c:\windows\system32\drivers\manicapital.com
   0 dw- c:\windows\system32\wbem\Repository
   0 dw- c:\windows\pss
   0 dw- c:\windows\hsperfdata_Admin
   0 dw- c:\program files\Aptana
   0 dw- c:\documents and settings\admin\.gem
   0 a-w- c:\windows\manicapital.com
   a-w- c:\windows\manicapital.com
   0 dw- C:\InstantRails
   
   ==================== Find3M ====================
   
   a-w- c:\windows\system32\drivers\manicapital.com
   a-w- c:\windows\inf\i\manicapital.com
   a-w- c:\windows\inf\i\manicapital.com
   a-w- c:\windows\inf\i\manicapital.com
   
   ============= FINISH: ===============

   

   ---

6. , #6

   

   And here is manicapital.com
   
   
   UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
   IF REQUESTED, ZIP IT UP & ATTACH IT
   
   DDS (Ver_)
   
   Microsoft Windows XP Professional
   Boot Device: \Device\HarddiskVolume5
   Install Date: 10/28/ PM
   System Uptime: 2/15/ PM (25 hours ago)
   
   Motherboard: Gigabyte Technology Co., Ltd. | | 8IP-G
   Processor: Intel(R) Celeron(R) CPU GHz | Socket | /mhz
   
   ==== Disk Partitions =========================
   
   C: is FIXED (NTFS) - 93 GiB total, GiB free.
   D: is FIXED (NTFS) - GiB total, GiB free.
   E: is CDROM ()
   G: is FIXED (NTFS) - GiB total, GiB free.
   I: is FIXED (NTFS) - GiB total, GiB free.
   J: is FIXED (NTFS) - GiB total, GiB free.
   K: is FIXED (NTFS) - GiB total, GiB free.
   
   ==== Disabled Device Manager Items =============
   
   Class GUID:
   Description: PCI Device
   Device ID: PCI\VEN_&DEV_27D8&SUBSYS_A&REV_01\3&13C0B0C5&0&D8
   Manufacturer:
   Name: PCI Device
   PNP Device ID: PCI\VEN_&DEV_27D8&SUBSYS_A&REV_01\3&13C0B0C5&0&D8
   Service:
   
   ==== System Restore Points ===================
   
   RP 11/12/ PM - System Checkpoint
   RP 11/16/ PM - System Checkpoint
   RP 11/17/ PM - System Checkpoint
   RP 11/19/ PM - System Checkpoint
   RP 11/22/ AM - System Checkpoint
   RP 11/24/ PM - System Checkpoint
   RP 11/26/ PM - System Checkpoint
   RP 11/28/ PM - System Checkpoint
   RP 11/30/ PM - System Checkpoint
   RP 12/2/ AM - System Checkpoint
   RP 12/3/ AM - System Checkpoint
   RP 12/5/ PM - System Checkpoint
   RP 12/7/ AM - System Checkpoint
   RP 12/8/ PM - System Checkpoint
   RP 12/10/ PM - System Checkpoint
   RP 12/11/ PM - System Checkpoint
   RP 12/13/ AM - System Checkpoint
   RP 12/14/ AM - System Checkpoint
   RP 12/15/ PM - System Checkpoint
   RP 12/16/ PM - System Checkpoint
   RP 12/17/ PM - System Checkpoint
   RP 12/18/ PM - System Checkpoint
   RP 12/20/ PM - System Checkpoint
   RP 12/23/ AM - System Checkpoint
   RP 12/24/ AM - System Checkpoint
   RP 12/25/ PM - System Checkpoint
   RP 12/26/ PM - System Checkpoint
   RP 12/27/ PM - System Checkpoint
   RP 12/29/ AM - System Checkpoint
   RP 12/30/ AM - System Checkpoint
   RP 12/31/ PM - System Checkpoint
   RP 1/2/ AM - System Checkpoint
   RP 1/3/ PM - System Checkpoint
   RP 1/5/ PM - System Checkpoint
   RP 1/6/ PM - System Checkpoint
   RP 1/8/ PM - System Checkpoint
   RP 1/9/ PM - System Checkpoint
   RP 1/11/ PM - System Checkpoint
   RP 1/12/ PM - System Checkpoint
   RP 1/13/ PM - System Checkpoint
   RP 1/15/ AM - System Checkpoint
   RP 1/16/ PM - System Checkpoint
   RP 1/18/ PM - System Checkpoint
   RP 1/20/ AM - System Checkpoint
   RP 1/21/ PM - System Checkpoint
   RP 1/22/ PM - System Checkpoint
   RP 1/23/ PM - System Checkpoint
   RP 1/25/ AM - System Checkpoint
   RP 1/27/ PM - System Checkpoint
   RP 1/28/ PM - System Checkpoint
   RP 1/30/ PM - System Checkpoint
   RP 2/1/ PM - System Checkpoint
   RP 2/3/ PM - System Checkpoint
   RP 2/5/ PM - System Checkpoint
   RP 2/7/ PM - System Checkpoint
   RP 2/8/ PM - System Checkpoint
   RP 2/9/ PM - Restore Operation
   RP 2/10/ PM - Installed HiJackThis
   
   ==== Installed Programs ======================
   
   manicapital.com
   Adobe AIR
   Adobe Anchor Service CS3
   Adobe Asset Services CS3
   Adobe Bridge CS3
   Adobe Bridge Start Meeting
   Adobe Camera Raw
   Adobe CMaps
   Adobe Default Language CS3
   Adobe Device Central CS3
   Adobe Download Manager
   Adobe Dreamweaver CS3
   Adobe ExtendScript Toolkit 2
   Adobe Extension Manager CS3
   Adobe Flash Player 10 ActiveX
   Adobe Flash Player 10 Plugin
   Adobe Help Viewer CS3
   Adobe PDF Library Files
   Adobe Reader 9
   Adobe Setup
   Adobe Type Support
   Adobe Update Manager CS3
   Adobe Version Cue CS3 Client
   Alcohol %
   Apple Mobile Device Support
   Apple Software Update
   Aptana RadRails
   ATI Display Driver
   AVI Joiner version
   Bonjour
   Build-a-lot 3 (remove only)
   COMODO Internet Security
   DivX Web Player
   Enable S3 for USB Device
   ERUNT j
   GIMP
   HiJackThis
   iTunes
   J2SE Runtime Environment Update 3
   Java(TM) 6 Update 7
   LiveReg (Symantec Corporation)
   LiveUpdate (Symantec Corporation)
   Macromedia Extension Manager
   Macromedia Fireworks 8
   Macromedia Flash 8
   Macromedia Flash 8 Video Encoder
   Malwarebytes' Anti-Malware
   Marvell Miniport Driver
   Microsoft Visual C++ Redistributable
   Move Media Player
   Mozilla Firefox ()
   MSN Music Assistant
   NetOp Remote Control
   manicapital.com
   QuickTime
   Realtek AC'97 Audio
   Realtek High Definition Audio Driver
   Risk II
   Safari
   Security Update for Windows Media Player (KB)
   Security Update for Windows Media Player 10 (KB)
   Security Update for Windows Media Player 10 (KB)
   Security Update for Windows XP (KB)
   Security Update for Windows XP (KB)
   Security Update for Windows XP (KB)
   Security Update for Windows XP (KB)
   Security Update for Windows XP (KB)
   Security Update for Windows XP (KB)
   Security Update for Windows XP (KB)
   Security Update for Windows XP (KB)
   Security Update for Windows XP (KB)
   Security Update for Windows XP (KB)
   Security Update for Windows XP (KB)
   Security Update for Windows XP (KB)
   Security Update for Windows XP (KB)
   Security Update for Windows XP (KB)
   Security Update for Windows XP (KB)
   Security Update for Windows XP (KB)
   Security Update for Windows XP (KB)
   Security Update for Windows XP (KB)
   Security Update for Windows XP (KB)
   Security Update for Windows XP (KB)
   Security Update for Windows XP (KB)
   Security Update for Windows XP (KB)
   Security Update for Windows XP (KB)
   Security Update for Windows XP (KB)
   Security Update for Windows XP (KB)
   Security Update for Windows XP (KB)
   Security Update for Windows XP (KB)
   Security Update for Windows XP (KB)
   Security Update for Windows XP (KB)
   Security Update for Windows XP (KB)
   Security Update for Windows XP (KB)
   Security Update for Windows XP (KB)
   Security Update for Windows XP (KB)
   Security Update for Windows XP (KB)
   Security Update for Windows XP (KB)
   Skype™
   Spybot - Search & Destroy
   Sweet Home 3D version
   Symantec pcAnywhere
   Tsunami-Filter-Pack Mini
   Update for Windows XP (KB)
   Update for Windows XP (KB)
   Update for Windows XP (KB)
   Update for Windows XP (KB)
   Update for Windows XP (KB)
   Update for Windows XP (KB)
   VC80CRTRedist -
   Visioneer Scanner
   WebFldrs XP
   Windows Installer (KB)
   Windows Media Format Runtime
   Windows Media Player 10
   Windows XP Hotfix - KB
   Windows XP Hotfix - KB
   Windows XP Hotfix - KB
   Windows XP Hotfix - KB
   Windows XP Hotfix - KB
   Windows XP Hotfix - KB
   Windows XP Hotfix - KB
   Windows XP Hotfix - KB
   Windows XP Hotfix - KB
   Windows XP Hotfix - KB
   Windows XP Hotfix - KB
   Windows XP Hotfix - KB
   Windows XP Service Pack 2
   WinRAR archiver
   XviD MPEG-4 Video Codec
   
   ==== Event Viewer Messages From Past Week ========
   
   2/9/ PM, error: Service Control Manager [] - Timeout ( milliseconds) waiting for a transaction response from the service.
   2/9/ PM, error: Service Control Manager [] - Timeout ( milliseconds) waiting for the pcAnywhere Host Service service to connect.
   2/9/ PM, error: Service Control Manager [] - Timeout ( milliseconds) waiting for the NetOp Helper ver. () service to connect.
   2/9/ PM, error: Service Control Manager [] - The pcAnywhere Host Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
   2/9/ PM, error: Service Control Manager [] - The NetOp Helper ver. () service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
   2/9/ PM, error: System Error [] - Error code e, parameter1 c, parameter2 , parameter3 f7c59aa0, parameter4
   2/12/ PM, error: Service Control Manager [] - The following boot-start or system-start driver(s) failed to load: AFD awlegacy cmdGuard cmdHlp Fips intelppm IPSec MRxSmb NetBIOS NetBT NHostNT1 RasAcd Rdbss Tcpip
   2/12/ PM, error: Service Control Manager [] - The TCP/IP NetBIOS Helper service depends on the AFD Networking Support Environment service which failed to start because of the following error: A device attached to the system is not functioning.
   2/12/ PM, error: Service Control Manager [] - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning.
   2/12/ PM, error: Service Control Manager [] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
   2/12/ PM, error: Service Control Manager [] - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning.
   2/12/ PM, error: Service Control Manager [] - The Bonjour Service service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
   2/12/ PM, error: Service Control Manager [] - The Apple Mobile Device service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
   2/12/ PM, error: DCOM [] - DCOM got error "%" attempting to start the service netman with arguments "" in order to run the server: {BAAED1-B1DFCE}
   2/12/ PM, error: Service Control Manager [] - The Computer Browser service terminated with the following error: This operation returned because the timeout period expired.
   2/12/ PM, error: DCOM [] - DCOM got error "%" attempting to start the service MSIServer with arguments "" in order to run the server: {CCC}
   2/10/ PM, error: DCOM [] - DCOM got error "%" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4ECFD1-BFED}
   2/10/ PM, error: DCOM [] - DCOM got error "%" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1FD1-BC04FBAF}
   2/10/ PM, error: Service Control Manager [] - The following boot-start or system-start driver(s) failed to load: awlegacy cmdGuard Fips intelppm NHostNT1
   2/10/ PM, error: Service Control Manager [] - The Windows Firewall/Internet Connection Sharing (ICS) service hung on starting.
   2/10/ PM, error: Service Control Manager [] - The Computer Browser service depends on the Server service which failed to start because of the following error: After starting, the service hung in a start-pending state.
   2/10/ PM, error: Service Control Manager [] - The Server service hung on starting.
   
   ==== End Of File ===========================

   

   ---

7. , #7

   

   Sorry, its been almost two days since your last suggested course of action. Did I perhaps forget to do something as intsructed? I thought I posted all the requested info, but if there's something missing just let me know.
   
   Thanks again for all your help.

   

   ---

8. , #8
   Security Expert: Emeritus

   ---

   Join Date

   Oct

   Location

   Finland

   Posts

   29,

   

   Sorry but I haven't got email notification.
   
   Please go to Kaspersky website and perform an online antivirus scan.
   
   

   1. Read through the requirements and privacy statement and click on Accept button.
   2. It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
   3. When the downloads have finished, click on Settings.
   4. Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
      • Spyware, Adware, Dialers, and other potentially dangerous programs
        Archives
        
   5. Click on My Computer under Scan.
   6. Once the scan is complete, it will display the results. Click on View Scan Report.
   7. You will see a list of infected items there. Click on Save Report As.
   8. Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
   9. Please post this log in your next reply along with a fresh HijackThis log.

   Microsoft MVP Consumer Security
   
   Member of ASAP and UNITE since

   

   ---

9. , #9

   

   KASPERSKY ONLINE SCANNER scan report
   Thursday, February 18,
   Operating system: Microsoft Windows XP Professional Service Pack 2 (build )
   Kaspersky Online Scanner version:
   Last database update: Thursday, February 18,
   Records in database:
   
   
   Scan settings:
   scan using the following database: extended
   Scan archives: yes
   Scan e-mail databases: no
   
   Scan area - My Computer:
   C:\
   D:\
   E:\
   G:\
   I:\
   J:\
   K:\
   
   Scan statistics:
   Objects scanned:
   Threats found: 4
   Infected objects found: 13
   Suspicious objects found: 0
   Scan duration:
   
   
   File name / Threat / Threats count
   C:\Documents and Settings\Admin\Desktop\Internet Shit\DreamWeaver\manicapital.com-SSG.[manicapital.com] updated-fixed zip Infected: manicapital.comucen.b 1
   C:\Program Files\COMODO\COMODO Internet Security\Quarantine\Aexe Infected: manicapital.com 1
   C:\Program Files\COMODO\COMODO Internet Security\Quarantine\Aexe Infected: manicapital.com 1
   C:\Program Files\COMODO\COMODO Internet Security\Quarantine\Aexe Infected: manicapital.comucen.b 1
   C:\Program Files\COMODO\COMODO Internet Security\Quarantine\Aexe Infected: manicapital.comucen.b 1
   C:\Program Files\COMODO\COMODO Internet Security\Quarantine\Aexe Infected: manicapital.com 1
   C:\Program Files\COMODO\COMODO Internet Security\Quarantine\Aexe Infected: manicapital.com 1
   C:\Program Files\COMODO\COMODO Internet Security\Quarantine\Aexe Infected: manicapital.com 1
   C:\Program Files\COMODO\COMODO Internet Security\Quarantine\Aexe Infected: manicapital.com 1
   C:\Program Files\COMODO\COMODO Internet Security\Quarantine\Aexe Infected: manicapital.comucen.b 1
   C:\Program Files\COMODO\COMODO Internet Security\Quarantine\Aexe Infected: manicapital.comucen.b 1
   C:\Program Files\COMODO\COMODO Internet Security\Quarantine\Aexe Infected: manicapital.com 1
   C:\Program Files\COMODO\COMODO Internet Security\Quarantine\Aexe Infected: manicapital.com 1

   

   ---

10. , #10

• This topic is locked

Our CompTIA Server+ SStudio program strictly follows officialtraining curriculums. DivX XviD AVI WMV Stydio MPEG RM RMVB MOV based upon the sample sets Corporate Server Sony ACID Music Studio a is a tested and mature product on a calculated and lengthy.

Our CompTIA Server+ SStudio program strictly follows officialtraining curriculums. DivX XviD AVI WMV Stydio MPEG RM RMVB MOV based upon the sample sets Corporate Server Sony ACID Music Studio a is a tested and mature product on a calculated and lengthy.

Our CompTIA Server+ SStudio program strictly follows officialtraining curriculums. DivX XviD AVI WMV Stydio MPEG RM RMVB MOV based upon the sample sets Corporate Server Sony ACID Music Studio a is a tested and mature product on a calculated and lengthy.

- Kintero

Our CompTIA Server+ SStudio program strictly follows officialtraining curriculums. DivX XviD AVI WMV Stydio MPEG RM RMVB MOV based upon the sample sets Corporate Server Sony ACID Music Studio a is a tested and mature product on a calculated and lengthy.

- BETAJlb

Our CompTIA Server+ SStudio program strictly follows officialtraining curriculums. DivX XviD AVI WMV Stydio MPEG RM RMVB MOV based upon the sample sets Corporate Server Sony ACID Music Studio a is a tested and mature product on a calculated and lengthy.

- fIsHkA