What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

I'm Computer Retarded, Help!

20 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Okay, I'm going to work on these next instructions and don't worry about the delay, I totally understand! Really quickly, I wanted to let you know I didn't complete those last set of instructions, but I'm assuming they don't matter now because I got that ztphxuy.exe file yesterday. Also, how do I be sure that I don't need that LTKRN1KN.dll file? When I deleted one of those infected .dlls the other day, I now get another pop up when I reboot stating it's missing. Is there a place you can go to get these .dll's back? lastly, I'm sure the article will help and I'll read it, but I can tell you this is ALL my fault. I let my LiveUpdate expire with NAV in March. So I'm sure that's why this happened. Plus my brother d/ling stupid stuff! I guess once I re d/l AVG, I can add that firewall, and then Uninstall Norton's.
Post #17
Back again, the killbox couldn't delete that file either. I have no idea what to do. I'm going to go ahead and delete all the cookies and such now. If you have anymore ideas, let me know!
Post #18 last edited
Okay, I've finished everything except getting rid of that one virus. I hope there is something I can do, and soon, since I really need an antivirus ASAP.

Here's the log:

Logfile of HijackThis v1.97.7
Scan saved at 12:36:20 AM, on 6/18/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\HPConfig.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\RadioSvr.exe
C:\WINDOWS\System32\carpserv.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\System32\atiptaxx.exe
C:\Program Files\Hewlett-Packard\HP Notebook Utilities\hptasks.exe
C:\PROGRA~1\HEWLET~1\ONE-TO~1\OneTouch.EXE
C:\windows\system\hpsysdrv.exe
C:\Windows\system32\HpSrvUI.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\America Online 8.0\aoltray.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\unzipped\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us4nb.hpwis.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://srch-us4nb.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.adelphiapowerpage.com/
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_12_0.dll
O2 - BHO: (no name) - {029CA12C-89C1-46a7-A3C7-82F2F98635CB} - C:\Program Files\Kontiki\bin\bh309190.dll
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &hp toolkit - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\HP\EXPLOREBAR\HPTOOLKT.DLL
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_12_0.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [HP TV Now] C:\Program Files\Hewlett-Packard\HP TV Now\HpTvNow.exe /RK
O4 - HKLM\..\Run: [HP Display Settings] C:\Program Files\Hewlett-Packard\HP Notebook Utilities\hptasks.exe /s
O4 - HKLM\..\Run: [QT4HPOT] C:\PROGRA~1\HEWLET~1\ONE-TO~1\OneTouch.EXE
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HP Presentation Ready] C:\Program Files\Hewlett-Packard\HP Presentation Ready\PresRdy.exe -r
O4 - HKLM\..\Run: [hp Silent Service] C:\Windows\system32\HpSrvUI.exe
O4 - HKLM\..\Run: [PreloadApp] c:\hp\drivers\printers\photosmart\hphprld.exe c:\hp\drivers\printers\photosmart\setup.exe -d
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ZingSpooler] C:\Program Files\Common Files\Zing\ZingSpooler.exe
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [WildTangent CDA] RUNDLL32.exe "C:\Program Files\WildTangent\Apps\CDA\cdaEngine0400.dll",cdaEngineMain
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - Global Startup: America Online 8.0 Tray Icon.lnk = C:\Program Files\America Online 8.0\aoltray.exe
O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Get It With Kontiki - res://C:\Program Files\Kontiki\bin\bh309190.dll/201
O8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O9 - Extra button: ICQ Pro (HKLM)
O9 - Extra 'Tools' menuitem: ICQ (HKLM)
O9 - Extra button: AIM (HKLM)
O9 - Extra button: Real.com (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} (Microsoft Office Template and Media Control) - http://office.microsoft.com/templates/ieawsdc.cab
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwa…director/sw.cab
O16 - DPF: {2A32B14F-4D29-4EA3-AC54-E9B19F436CE7} (Scanner Class) - http://www.trojanscan.com/trojanscan/TDECntrl.CAB
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst0401.cab
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab
O16 - DPF: {597C45C2-2D39-11D5-8D53-0050048383FE} (OPUCatalog Class) - http://office.microsoft.com/productupdates/content/opuc.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…StatsClient.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/…7649.6517708333
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yahoo.com/…/ymmapi_416.dll
O16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwa…ash/swflash.cab

****EDIT*****
I'm going to head to bed, after 1am here, but feel free to leave me any ideas or more instructions and I'll do it all tomorrow!
Thanks so much!!!!
~Evoka
Post #19
Hi Evoka,
First of all I want to back you up a bit as I think I may have missed something. Any files we have deleted are not needed as they are not doing their job. There is a website at microsoft for checking DLL files that windows needs.http://support.microsoft.com/default.aspx?…ion/dllinfo.asp If the file is a windows system file that is corrupt, we can restore it from your Windows CD if necessary. Please copy the information from the popup about the missing file, and paste it in your next post.


1. Please double check to make certain that all hidden files are showing, by doing the following:

* Click Start.
* Open My Computer.
* Select the Tools menu and click Folder Options.
* Select the View Tab.
* Under the Hidden files and folders heading select Show hidden files and folders.
* Uncheck the Hide protected operating system files (recommended) option.
* Click Yes to confirm.
* Click OK.

2. Also please turn off system restore again and we will re-enable it after you are completely clean.

To Turn off System Restore.
*On the Desktop, right-click My Computer.
*Click Properties.
*Click the System Restore tab.
*Check Turn off System Restore.
*Click Apply, and then click OK.
*Reboot.to complete the process


3. Now I would like you to check a file for me please as I can find no information about it. It appears to be a file from HP computers but malware at times drops a file that looks like a legit file with a similar name to the valid one.: For the exe file I would like to know the type of file (archive, read-only, or hidden), size, creation date, file version, copyright info and description.

C:\WINDOWS\system32\HPConfig.exe


4. Now please go back and search for the files that you were unable to find earlier I couldn't tell which 3 files you were able to delete because I had listed 8 files for deletion. (3 were from programs you uninstalled so I assumed that it wasn't those 3 you were referring to)

5. I would again like you to check your Windows folder and your Windows\system32 folder for names like the random file names. Please check the properties of each of them.(the $ is the icon for the file if it is there). What I would like you to tell me is the type of application (read-only, hidden or archive), creation date, version, copyright info, description, any info in the box below the version information. Locate the files and save the path to each file. eg: C:|Windows\System32\xxxxx.dll so that you can copy and paste it into Killbox later in Safe Mode

C:\any folder\LTKRN1KN.dll
C:\WINDOWS\lglyr.exe
C:\any folder\ctphwzwfd
C:\WINDOWS\System32\dhstyb.exe

6. Now boot into SAFE MODE by tapping F8 repeatedly while booting up to the menu where you can choose Safe Mode

7. While in Safe Mode use killbox to navigate to C:\Windows and C:\Windows\System32\ and delete the files by copying and pasting the exact path and file name into the box and click Kill File. (if you have deleted any of these in the previous steps check to see if they have returned)

C:\Windows\System32\LTKRN1KN.dll
C:\WINDOWS\lglyr.exe
C:\probably Windows\probably System32\ctphwzwfd
C:\probably Windows\probably System32\netmsiij
C:\WINDOWS\System32\dhstyb.exe

8. While still in Safe Mode open CWShredder and close ALL other windows.
* Click Fix and let shredder fix anything that it finds

9. REBOOT into normal mode

10. Do another Online AV scan at
Online Panda AV Scan
Housecall by Trend Micro

11. Finally scan again with HijackThis and POST in this thread. Please include the information about the properties of any files you found and any other pertinent info about your computer.

Good Luck!.
Post #20 last edited
I've completed the first 4 steps. Here is the information you requested on C:\WINDOWS\system32\HPConfig.exe: Type of File: Application Description: HPConfig Module Size 148kb Created: Wednesday, May29th, 2002, 4:10:16pm File Version: 3.0.0.7 Copyright: Hewlett-Packard Copyright © 1999-2002 Attributes: Both were unchecked (no hidden or read-only) about number 4. I think I confused you with something else, but I went back and looked at my notes. Out of the 8 deletions, only C:\Windows\System32\ztphxuy.exe was able to be located and deleted. The others Windows\temp\tpdir\setup.exe.exe, Windows\system32\P2p Networking\P2P Networking.exe, Program Files\Altnet\Points Manager\Points Manager.exe, Program Files\Viewpoint\Viewpoint Manger\ViewMgr.exe, C:\Windows\lglyr.exe, Windows\system32\dhstyb.exe, windows\alchem.exe were already gone. So were the additional 4 folders you asked me to delete. Now I'm at step 5, still a little confused trying to locate files that look random. But this is what I've found so far: The $ Icon: C:\Windows\earnmoney type: icon size 9.14kb Created: Sunday, May 11, 2003 8:25:15pm Attributes: unchecked (no hidden or read-only) Summary: Summary properties are not available. I mentioned these two before, but you didn't comment on them, so I don't know if they are good or bad, but here is the info I've found: C:\Windows\LTP$VPN Type: 905 file Open With: Unknown Application Size 8.40mb Created: Wednesday, June 16, 2004 1:56:47pm Attributes: Unchecked (no hidden or read-only) C:\Windows\VPTNFILE is exactly the same as above. I don't know whether to get rid of these or not. I also ran upon the file alchem, it alerted me because we deleted alchem.exe and i didn't know if it had anything to do with the .exe or not, here's the properties: C:\Windows\alchem Type: Configuration Setting Opens with: Notepad Size: 326 bytes created Sunday, May 9, 2004 11:27am Modified Tuesday, June 15, 2004 2:34pm Attributes: unchecked (no hidden or read-only) Summary: None Now, here is where I really get confused. There are two LTKRN1Kn files, one is .dll (which has the trojan) and one that is .dat. There are also two netmsiij files, one .dll and one .dat The LTKRN1KN dat and netmsiij dat are identical except for the creation date. Plus I found a LTKRN13n.dll, and its the only one with all the information. Here's the properties on all 5 of the files: C:\Windows\System32\netmsiij.dat type: Dat file Open with: Unknown Application Size: 16 bytes Created: Monday, May 24, 2004 11:39:59am Attributes: unchecked (no hidden or read only) Summary: Nothing C:\Windows\System32\LTKRN1KN.dat type: Dat file Open with: Unknown Application Size: 16 bytes Created: July 31, 2002 2:25pm Attributes: unchecked (no hidden or read only) Summary: Nothing C:\Windows\System32\netmsiij.dll type: Application Extension Open with: Unknown Application Size: 136kb Created: Tuesday, January 1, 1980 3:00am Attributes: unchecked (no hidden or read only) Summary: Nothing C:\Windows\System32\LTKRN1KN.dll type: Application Extension Open with: Unknown Application Size: 138kb Created: Wednesday, July 31 2002, 2:25pm Attributes: unchecked (no hidden or read only) Summary: Nothing C:\Windows\System32\LTKRN13n.dll type: Application Extension Open with: Unknown Application Size: 406kb Created: Wednesday, July 31 2002, 2:25pm Attributes: unchecked (no hidden or read only) Version: 13.0.0.17 Description: Leadtoos® DLL for Win32 Copyright © 1991 - 2001 Lead Technology. lr Since I know KTKRN1KN.dll has the virus, I'm going to go into safe mode and tryto kill box it. But I'm waiting for an answer from you before I delete any others. Until I hear from you, I will go ahead and run an online scan again. Thanks for being so patient! ~Evoka ***EDIT*** Killbox could not delete LTKRN1KN.dll in safe mode either.
Post #21
This is the information I needed to be able to give you further instructions. I could not tell you what to delete without knowing what the properties say.

Here is the next set of instructions but there will be more after these unfortunately. You have a very stubborn malware that is going to be hard to get rid of First question do you have a program on your computer by Lead Tools. Check in Add Remove Programs in the Control Panel and in your Program Files for the program. If you find it in the Control Panel please uninstall it. When you attempted to delete LTKRN1KN dll with killbox did you get a message that the file was in use? Please do the following as the next step and report back on the Lead Tools program.

Please try searching for these files again as they may become visible during this process: If you find them please add them to the list of files to delete in killbox:

C:\Windows\lglyr.exe
C:\Windows\system32\dhstyb.exe
C:\Windows\temp\tpdir\setup.exe.exe


1. Please Reboot back into Safe Mode and open Killbox (all other windows including IE closed please)

2. Copy and paste the following entries exactly into Killbox one at a time in order: - we will delete the *.dat files first and then the *.dll's.

C:\Windows\earnmoney
C:\Windows\LTP$VPN
C:\Windows\System32\LTKRN1KN dat <— Or the folder it is in
C:\Windows\System32\LTKRN1KN dll <— Or the folder it is in
C:\Windows\System32\netmsiij.dat
C:\Windows\System32\netmsiij.dll
C:\Windows\alchem <— if it is there check also for the .exe and delete if you find it

REBOOT back into safe mode to continue:

1. In safe mode please Scan again with HijackThis (ALL WINDOWS CLOSED EXCEPT HJT)

2. POST a new log file here in this thread using 'Add Reply' to see what is left to clean.

These hijacks keep coming back until we find and delete all of the files. Hopefully we have them all now.
Post #22
I was just about to write you, I just did a PandaScan and they found 7 viruses (including the LTKRN1N.dll) and it was able to disinfect all but 3. It finally disinfected that LTKRN1N.dll. The other three are (and I've already found them, just didn't know if I could delete them or not): C:\Documents&Settings\Owner\Local Settings\Temp\polmx.exe C:\Documents&Settings\Owner\Local Settings\Temp\poltt.cab[poltt.exe] C:\Documents&Settings\Owner\Local Settings\Temp\polttbho.cab[plottbho.exe] I have all the logs save, if you want to see anything. I did not find Lead Tools on my Control panel. Do I still need to delete those LTKRN1N dats & dlls? I'm going to go search for those 3 files in the meantime.
Post #23
Go ahead and delete those files that Panda found. You might also want to empty the entire Temp folder, Temporary Internet Files and your Recycle Bin at the same time as some viruses hide there. You may still find these files on your hard drive: C:\Windows\System32\LTKRN1KN dat and C:\Windows\System32\LTKRN1KN dll but I suspect that Panda probably got it. If you find them, use Killbox to delete it. Those files with the dates of July 31,2002 should be left alone as they appear to be legit and HPConfig is a legit Hewlett Packard file. Amy files found by any of the AV or Trojan scans are either infected or are the actual virus or trojan. You should always delete those files if you can. If the file in its uninfected state is needed by windows, it can be replaced with a clean version from your Windows CD. Hope this helps, will wait for your next HJT log file.
Post #24
Okay, I deleted those 3 files Panda found. Then I went into Safe Mode and made sure that they were gone. Then I ran CWShredder again. I also made sure that all of the files that I have deleted were gone, they were. Then for the control panel, I dumped my recycle bin, Temp, temporary internet files, and history.

Then I went to C:\Documents & Settings\Owner\Local Settings\Temp and searched around. This is where I found a few of those nasty files we've been looking for. I found another alchem file, a PSPexe, and some other familiar things. I deleted all of them and all the files I knew I could delete(jpg/bmp/html).

I wasn't sure if you are supposed to delete everything in that particular TEMP folder, but I tried and it popped up an error stating a file could not be moved, cause it didn't have the right path or something. I then found it in one of the Temp\Temporary Internet Files folders. I tried to delete it myself, it won't let you, when you right click all it will do is open or send to. I tried to copy the path and kill it with killbox, the name wouldn't even go into the path. I then tried to copy just the title of the file and it wouldn't let me. So I took a screen capture and this is what it looks like:

🖼Click to load external image (Posted Image)

What your thoughts on that file? I also need to know if everything in that TEMP folder can be replaced or that it doesn't matter, before I delete anything left. It's a bunch of Twaintec and Twunk files, yahoo messager install, .abi, etc… Also, am I supposed to manually go in and dump that Temp too?

Now here's the HJT log:

Logfile of HijackThis v1.97.7
Scan saved at 5:49:38 PM, on 6/19/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\HPConfig.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\RadioSvr.exe
C:\WINDOWS\System32\carpserv.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\System32\atiptaxx.exe
C:\Program Files\Hewlett-Packard\HP Notebook Utilities\hptasks.exe
C:\PROGRA~1\HEWLET~1\ONE-TO~1\OneTouch.EXE
C:\windows\system\hpsysdrv.exe
C:\Windows\system32\HpSrvUI.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\America Online 8.0\aoltray.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\unzipped\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us4nb.hpwis.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://srch-us4nb.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.adelphiapowerpage.com/
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_12_0.dll
O2 - BHO: (no name) - {029CA12C-89C1-46a7-A3C7-82F2F98635CB} - C:\Program Files\Kontiki\bin\bh309190.dll
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &hp toolkit - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\HP\EXPLOREBAR\HPTOOLKT.DLL
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_12_0.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [HP TV Now] C:\Program Files\Hewlett-Packard\HP TV Now\HpTvNow.exe /RK
O4 - HKLM\..\Run: [HP Display Settings] C:\Program Files\Hewlett-Packard\HP Notebook Utilities\hptasks.exe /s
O4 - HKLM\..\Run: [QT4HPOT] C:\PROGRA~1\HEWLET~1\ONE-TO~1\OneTouch.EXE
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HP Presentation Ready] C:\Program Files\Hewlett-Packard\HP Presentation Ready\PresRdy.exe -r
O4 - HKLM\..\Run: [hp Silent Service] C:\Windows\system32\HpSrvUI.exe
O4 - HKLM\..\Run: [PreloadApp] c:\hp\drivers\printers\photosmart\hphprld.exe c:\hp\drivers\printers\photosmart\setup.exe -d
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ZingSpooler] C:\Program Files\Common Files\Zing\ZingSpooler.exe
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [WildTangent CDA] RUNDLL32.exe "C:\Program Files\WildTangent\Apps\CDA\cdaEngine0400.dll",cdaEngineMain
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - Global Startup: America Online 8.0 Tray Icon.lnk = C:\Program Files\America Online 8.0\aoltray.exe
O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Get It With Kontiki - res://C:\Program Files\Kontiki\bin\bh309190.dll/201
O8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O9 - Extra button: ICQ Pro (HKLM)
O9 - Extra 'Tools' menuitem: ICQ (HKLM)
O9 - Extra button: AIM (HKLM)
O9 - Extra button: Real.com (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} (Microsoft Office Template and Media Control) - http://office.microsoft.com/templates/ieawsdc.cab
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwa…director/sw.cab
O16 - DPF: {2A32B14F-4D29-4EA3-AC54-E9B19F436CE7} (Scanner Class) - http://www.trojanscan.com/trojanscan/TDECntrl.CAB
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst0401.cab
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab
O16 - DPF: {597C45C2-2D39-11D5-8D53-0050048383FE} (OPUCatalog Class) - http://office.microsoft.com/productupdates/content/opuc.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…StatsClient.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/…7649.6517708333
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yahoo.com/…/ymmapi_416.dll
O16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwa…ash/swflash.cab

I think we are really close to being done, or at least I hope.
~Evoka
Post #25
Good news, I redownloaded AVG and it found no viruses! Thank you so much for helping me so patiently. Now I'm learning how to maintain my computer better. ~Evoka
Post #26
Sounds great! let me know if you have any problems in the next day or so. I will leave this open until then so you can post back in this thread if you find that you have problems or questions. Don't forget to re-enable your System Restore : Turn ON System Restore. On the Desktop, right-click My Computer. Click Properties. Click the System Restore tab. UN-Check *Turn off System Restore*. Click Apply, and then click OK. There are a few other small programs which will help with security that are mentioned in 'How Did I Get Infected In The First Place' at the bottom of this post. They will help you keep your computer clean Glad we could help!
Post #27
Thank you SOOOO much. I think everything is okay. AVG & Zone Alarm are working well. I have a few things still funny, but I believe they are hardware problems that I need to take to Bestbuy, I have a warantee. Glad I bought that. Thanks again! ~Evoka
Post #28
Your welcome hope it stays that way!

If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.

If this is not your thread please start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI