<https://forums.techguy.org/threads/rootkit-foop.537829/>
<http://schema.org/articleBody>
"According to spyware doctor (see screenie), I have rootkit.foop.  I googled it and found some info on the swd website, and a suggestion to scan in safe mode with avg.  I tried the safe mod scan and avg didn't find it in the registry (i got new defs right before i scanned).  I have spybot + adaware, and normally they work fine for me - every now and then I d/l spyware doctor and do a trial scan to make sure I am safe...this is the first time I have come across something I can't get rid of by myself.  This is the file I have from hijackthis!:\r\nLogfile of HijackThis v1.99.1\r\nScan saved at 6:59:18 PM, on 1/23/2007\r\nPlatform: Windows 2000 SP4 (WinNT 5.00.2195)\r\nMSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)\r\n\r\nRunning processes:\r\nD:\\WINNT\\System32\\smss.exe\r\nD:\\WINNT\\system32\\csrss.exe\r\nD:\\WINNT\\system32\\winlogon.exe\r\nD:\\WINNT\\system32\\services.exe\r\nD:\\WINNT\\system32\\lsass.exe\r\nD:\\WINNT\\system32\\svchost.exe\r\nD:\\WINNT\\system32\\spoolsv.exe\r\nD:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgamsvr.exe\r\nD:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgupsvc.exe\r\nD:\\Program Files\\Cisco Systems\\VPN Client\\cvpnd.exe\r\nD:\\WINNT\\system32\\svchost.exe\r\nD:\\WINNT\\system32\\hidserv.exe\r\nD:\\WINNT\\system32\\nvsvc32.exe\r\nD:\\WINNT\\system32\\regsvc.exe\r\nD:\\WINNT\\system32\\MSTask.exe\r\nD:\\Program Files\\Common Files\\Symantec Shared\\CCPD-LC\\symlcsvc.exe\r\nD:\\WINNT\\System32\\WBEM\\WinMgmt.exe\r\nD:\\WINNT\\system32\\svchost.exe\r\nD:\\Program Files\\Sana Security\\Primary Response SafeConnect\\agent\\bin\\SanaAgent.exe\r\nD:\\WINNT\\system32\\svchost.exe\r\nD:\\WINNT\\Explorer.EXE\r\nD:\\WINNT\\system32\\RUNDLL32.EXE\r\nD:\\Program Files\\Intel\\NCS\\PROSet\\PRONoMgr.exe\r\nD:\\WINNT\\system32\\sstray.exe\r\nD:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\r\nD:\\Program Files\\Filseclab\\xfilter\\xfilter.exe\r\nD:\\Program Files\\Picasa2\\PicasaMediaDetector.exe\r\nD:\\Program Files\\Java\\jre1.5.0_06\\bin\\jusched.exe\r\nD:\\Program Files\\CyberLink\\PowerDVD\\PDVDServ.exe\r\nD:\\Program Files\\Common Files\\Microsoft Shared\\Works Shared\\WkUFind.exe\r\nD:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgcc.exe\r\nD:\\Program Files\\Sana Security\\Primary Response SafeConnect\\agent\\bin\\SanaSafeConnect.exe\r\nD:\\Program Files\\Logitech\\MouseWare\\system\\em_exec.exe\r\nD:\\Program Files\\Google\\Google Talk\\googletalk.exe\r\nD:\\Program Files\\Spyware Doctor\\swdoctor.exe\r\nD:\\Program Files\\QUICKENW\\QWDLLS.EXE\r\nD:\\Program Files\\Yahoo!\\Yahoo! Widget Engine\\YahooWidgetEngine.exe\r\nD:\\Program Files\\Yahoo!\\Yahoo! Widget Engine\\YahooWidgetEngine.exe\r\nD:\\Program Files\\Yahoo!\\Yahoo! Widget Engine\\YahooWidgetEngine.exe\r\nD:\\Program Files\\Yahoo!\\Yahoo! Widget Engine\\YahooWidgetEngine.exe\r\nD:\\Program Files\\Sana Security\\Primary Response SafeConnect\\agent\\bin\\SanaMonitor.exe\r\nD:\\Program Files\\Mozilla Firefox\\firefox.exe\r\nD:\\Program Files\\WinRAR\\WinRAR.exe\r\nD:\\DOCUME~1\\ADMINI~1\\LOCALS~1\\Temp\\Rar$EX02.016\\HijackThis.exe\r\n\r\nR1 - HKCU\\Software\\Microsoft\\Internet Explorer\\Main,Search Bar = http://us.rd.yahoo.com/customize/ycomp/defaults/sb/*http://www.yahoo.com/search/ie.html\r\nR1 - HKCU\\Software\\Microsoft\\Internet Explorer\\Main,Search Page = http://us.rd.yahoo.com/customize/ycomp/defaults/sp/*http://www.yahoo.com\r\nR0 - HKCU\\Software\\Microsoft\\Internet Explorer\\Main,Start Page = https://login.yahoo.com/config/login_verify2?&.src=ym\r\nR1 - HKCU\\Software\\Microsoft\\Internet Explorer\\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com\r\nO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\\Program Files\\Adobe\\Acrobat 5.0\\Reader\\ActiveX\\AcroIEHelper.ocx\r\nO2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\\Program Files\\Java\\jre1.5.0_06\\bin\\ssv.dll\r\nO3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\\WINNT\\system32\\msdxm.ocx\r\nO4 - HKLM\\..\\Run: [Synchronization Manager] mobsync.exe /logon\r\nO4 - HKLM\\..\\Run: [NvCplDaemon] RUNDLL32.EXE D:\\WINNT\\system32\\NvCpl.dll,NvStartup\r\nO4 - HKLM\\..\\Run: [nwiz] nwiz.exe /install\r\nO4 - HKLM\\..\\Run: [NvMediaCenter] RUNDLL32.EXE D:\\WINNT\\system32\\NvMcTray.dll,NvTaskbarInit\r\nO4 - HKLM\\..\\Run: [PRONoMgr.exe] D:\\Program Files\\Intel\\NCS\\PROSet\\PRONoMgr.exe\r\nO4 - HKLM\\..\\Run: [nForce Tray Options] sstray.exe /r\r\nO4 - HKLM\\..\\Run: [TkBellExe] \"D:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\"  -osboot\r\nO4 - HKLM\\..\\Run: [XFILTER] \"D:\\Program Files\\Filseclab\\xfilter\\xfilter.exe\" -a\r\nO4 - HKLM\\..\\Run: [Picasa Media Detector] D:\\Program Files\\Picasa2\\PicasaMediaDetector.exe\r\nO4 - HKLM\\..\\Run: [SunJavaUpdateSched] D:\\Program Files\\Java\\jre1.5.0_06\\bin\\jusched.exe\r\nO4 - HKLM\\..\\Run: [RemoteControl] \"D:\\Program Files\\CyberLink\\PowerDVD\\PDVDServ.exe\"\r\nO4 - HKLM\\..\\Run: [NeroCheck] D:\\WINNT\\system32\\\\NeroCheck.exe\r\nO4 - HKLM\\..\\Run: [Microsoft Works Update Detection] D:\\Program Files\\Common Files\\Microsoft Shared\\Works Shared\\WkUFind.exe\r\nO4 - HKLM\\..\\Run: [monrebbk] D:\\WINNT\\system32\\monrebbk.exe\r\nO4 - HKLM\\..\\Run: [AVG7_CC] D:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgcc.exe /STARTUP\r\nO4 - HKLM\\..\\Run: [QuickTime Task] \"D:\\Program Files\\QuickTime\\qttask.exe\" -atboottime\r\nO4 - HKLM\\..\\Run: [Logitech Utility] Logi_MwX.Exe\r\nO4 - HKLM\\..\\Run: [MSConfig] D:\\DOCUME~1\\ADMINI~1\\LOCALS~1\\Temp\\Rar$EX00.735\\msconfig.exe /auto\r\nO4 - HKLM\\..\\Run: [SanaSafeConnect] \"D:\\Program Files\\Sana Security\\Primary Response SafeConnect\\agent\\bin\\SanaSafeConnect.exe\"\r\nO4 - HKCU\\..\\Run: [monrebbk] D:\\WINNT\\system32\\monrebbk.exe\r\nO4 - HKCU\\..\\Run: [googletalk] \"D:\\Program Files\\Google\\Google Talk\\googletalk.exe\" /autostart\r\nO4 - HKCU\\..\\Run: [Spyware Doctor] \"D:\\Program Files\\Spyware Doctor\\swdoctor.exe\" /Q\r\nO4 - Startup: Yahoo! Widget Engine.lnk = D:\\Program Files\\Yahoo!\\Yahoo! Widget Engine\\YahooWidgetEngine.exe\r\nO4 - Global Startup: Billminder.lnk = D:\\Program Files\\QUICKENW\\BILLMIND.EXE\r\nO4 - Global Startup: Quicken Startup.lnk = D:\\Program Files\\QUICKENW\\QWDLLS.EXE\r\nO9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - D:\\PROGRA~1\\SPYWAR~2\\tools\\iesdpb.dll (file missing)\r\nO16 - DPF: {3451DEDE-631F-421C-8127-FD793AFC6CC8} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/asa/ctrl/SymAData.cab\r\nO16 - DPF: {44990200-3C9D-426D-81DF-AAB636FA4345} (Symantec SmartIssue) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsi.cab\r\nO16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsr.cab\r\nO20 - Winlogon Notify: tecake - D:\\WINNT\\SYSTEM32\\ejsuzabq.dll\r\nO23 - Service: Automatic LiveUpdate Scheduler - Unknown owner - D:\\Program Files\\Symantec\\LiveUpdate\\ALUSchedulerSvc.exe (file missing)\r\nO23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - D:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgamsvr.exe\r\nO23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - D:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgupsvc.exe\r\nO23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - D:\\Program Files\\Cisco Systems\\VPN Client\\cvpnd.exe\r\nO23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - D:\\WINNT\\System32\\dmadmin.exe\r\nO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\\Program Files\\Common Files\\InstallShield\\Driver\\1050\\Intel 32\\IDriverT.exe\r\nO23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - D:\\Program Files\\Intel\\NCS\\Sync\\NetSvc.exe\r\nO23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\\WINNT\\system32\\nvsvc32.exe\r\nO23 - Service: SanaSafeConnectAgent - Unknown owner - D:\\Program Files\\Sana Security\\Primary Response SafeConnect\\agent\\bin\\SanaAgent.exe\" SanaSafeConnectAgent (file missing)\r\nO23 - Service: Symantec Core LC - Symantec Corporation - D:\\Program Files\\Common Files\\Symantec Shared\\CCPD-LC\\symlcsvc.exe\r\nThanks!"
<https://forums.techguy.org/threads/rootkit-foop.537829/>