What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Slow, Ate-up, Computer

4 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I have winad.exe running on my computer and a few other things going on I think are due to spyware. Can you please look ay my HJT log and help? Please?

Logfile of HijackThis v1.98.2
Scan saved at 12:10:18 AM, on 10/21/2004
Platform: Windows 2000 SP2 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\LEXBCES.EXE
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\LEXPPS.EXE
C:\WINNT\System32\cisvc.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\mnmsrvc.exe
C:\PROGRA~1\Navnt\navapsvc.exe
C:\PROGRA~1\Navnt\npssvc.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\System32\locator.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\tcpsvcs.exe
C:\WINNT\System32\snmp.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\mspmspsv.exe
D:\proe\flexlm\i486_nt\obj\lmgrd.exe
D:\proe\flexlm\i486_nt\obj\ptc_d.exe
C:\PROGRA~1\Navnt\alertsvc.exe
C:\WINNT\Explorer.EXE
C:\WINNT\System32\Promon.exe
C:\Program Files\Navnt\POPROXY.EXE
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINNT\loadqm.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common files\updater\wupdater.exe
C:\Program Files\Common Files\Real\Update_OB\rnathchk.exe
C:\WINNT\System32\qsqvlr.exe
C:\WINNT\inf\accdns.exe
C:\WINNT\System32\webcamupdate.exe
C:\Program Files\Navnt\navapw32.exe
C:\WINNT\System32\cidaemon.exe
C:\HJT\HijackThis.exe
C:\WINNT\System32\nvrsnl.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://searchmiracle.com/sp.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.my.delleworks.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchmiracle.com/sp.php
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q=
R3 - URLSearchHook: IncrediFindBHO Class - {5D60FF48-95BE-4956-B4C6-6BB168A70310} - C:\PROGRA~1\INCRED~1\BHO\INCFIN~1.DLL (file missing)
O2 - BHO: Band Class - {01F44A8A-8C97-4325-A378-76E68DC4AB2E} - C:\WINNT\systb.dll
O2 - BHO: &EliteBar - {28CAEFF3-0F18-4036-B504-51D73BD81ABC} - C:\WINNT\EliteToolBar\EliteToolBar version 53.dll (file missing)
O2 - BHO: CATLEvents Object - {DF57FEB6-9BCE-45E3-AA65-BE327B8CCE7F} - C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\sndcca.dat
O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [Promon.exe] Promon.exe
O4 - HKLM\..\Run: [NPS Event Checker] C:\PROGRA~1\Navnt\npscheck.exe
O4 - HKLM\..\Run: [Norton eMail Protect] C:\Program Files\Navnt\POPROXY.EXE
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [CreateCD50] "C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe" -r
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe -osboot
O4 - HKLM\..\Run: [STOPzilla] "D:\Program Files\STOPzilla!\Stopzilla.exe" /autorun
O4 - HKLM\..\Run: [alchem] C:\WINNT\alchem.exe
O4 - HKLM\..\Run: [Belt] C:\WINNT\Belt.exe
O4 - HKLM\..\Run: [mfcole] C:\WINNT\Windows Update Setup Files\mfcole.exe
O4 - HKLM\..\Run: [updater] C:\Program Files\Common files\updater\wupdater.exe
O4 - HKLM\..\Run: [Win Server Updt] C:\WINNT\wupdt.exe
O4 - HKLM\..\Run: [zekjrqhg] C:\WINNT\System32\qsqvlr.exe
O4 - HKLM\..\Run: [*mfcole] C:\WINNT\Windows Update Setup Files\mfcole.exe
O4 - HKLM\..\Run: [*rundns] C:\WINNT\msagent\INTL\rundns.exe
O4 - HKLM\..\Run: [Winspl] C:\WINNT\System32\winsplx.jpg
O4 - HKLM\..\Run: [*cmdkb] C:\WINNT\msagent\cmdkb.exe
O4 - HKLM\..\Run: [*hardmain] C:\WINNT\system32\COM\hardmain.exe
O4 - HKLM\..\Run: [*mp3font] C:\WINNT\Fonts\mp3font.exe
O4 - HKLM\..\Run: [*winad] C:\WINNT\Web\winad.exe
O4 - HKLM\..\Run: [*accdns] C:\WINNT\inf\accdns.exe
O4 - HKLM\..\Run: [7363528.exe] C:\WINNT\System32\7363528.exe
O4 - HKLM\..\RunOnce: [*accdns] C:\WINNT\inf\accdns.exe rerun
O4 - HKCU\..\Run: [drmstor] C:\WINNT\System32\drmstor.exe
O4 - HKCU\..\Run: [nvrsnl] C:\WINNT\System32\nvrsnl.exe
O4 - HKCU\..\Run: [IcqBeta] C:\WINNT\System32\webcamupdate.exe
O4 - HKCU\..\RunOnce: [*MS Setup] C:\WINNT\system\vgaurl.exe ren
O4 - Global Startup: Norton AntiVirus AutoProtect.lnk = C:\Program Files\Navnt\navapw32.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: Open Picture in &Microsoft PhotoDraw - res://C:\PROGRA~1\MICROS~3\Office\1033\phdintl.dll/phdContext.htm
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE
O12 - Plugin for .mid: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .TIF: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O16 - DPF: Dialpad US Java Applet - http://www.dialpad.com/applet/src/vscp.cab
O16 - DPF: {00000000-d9e3-4bc6-a0bd-3d0ca4be5271} -
O16 - DPF: {00000012-890E-4AAC-AFD9-EFF6954A34DD} -
O16 - DPF: {018B7EC3-EECA-11D3-8E71-0000E82C6C0D} - http://www.adultcash.com/sdialer/instantaccess.exe
O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} (MetaStreamCtl Class) - http://components.metastream.com/MTSInstal…MetaStream3.cab
O16 - DPF: {1D0D9077-3798-49BB-9058-393499174D5D} - file://c:\counter.cab
O16 - DPF: {1EEC3C99-7AA3-4F6E-B381-AF6942B51618} (pup.setup) - http://www.lazychestnuts.net/0015/ph/pup.CAB
O16 - DPF: {38578BF0-0ABB-11D3-9330-0080C6F796A1} (Create & Print ActiveX Plug-in) - http://www.imgag.com/cp/install/AxCtp.cab
O16 - DPF: {60F47E29-4A42-11D2-83ED-02608CA10990} (SmartLOOK CAD Viewer Control) - http://www.i-markinc.com/SmartLOOKX/SmartLOOKX.cab
O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} (AcDcToday Control) - file://E:\Program Files\AutoCAD 2000i\AcDcToday.ocx
O16 - DPF: {AA14C86B-DA22-4811-8186-BB496A299C5F} (Be Here TotalView Player ActiveX Control, Version 3.0) - http://www.premiereinteractive.com/behere/…eoViewer3_0.cab
O16 - DPF: {C6637286-300D-11D4-AE0A-0010830243BD} (InstaFred Control) - file://E:\Program Files\AutoCAD 2000i\InstFred.ocx
O16 - DPF: {CA034DCC-A580-4333-B52F-15F98C42E04C} (Downloader Class) - http://www.stopzilla.com/_download/Auto_Installer/dwnldr.cab
O16 - DPF: {E8EDB60C-951E-4130-93DC-FAF1AD25F8E7} (MoneyTree Dialer) - http://cdn.climaxbucks.com/internet-optimi…DistIOcrack.CAB
O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview Control) - file://E:\Program Files\AutoCAD 2000i\AcPreview.ocx
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://fdl.msn.com/public/chat/msnchat45.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{417BA027-7897-4000-8149-0778C8376543}: NameServer = 68.57.192.5,68.57.192.6
O17 - HKLM\System\CS1\Services\Tcpip\..\{417BA027-7897-4000-8149-0778C8376543}: NameServer = 68.57.192.5,68.57.192.6
O17 - HKLM\System\CS2\Services\Tcpip\..\{417BA027-7897-4000-8149-0778C8376543}: NameServer = 68.57.192.5,68.57.192.6
Post #2
Greetings and welcome to TomCoyote.org!

Download Killbox.zip

Extract it from the zip file then double-click on Killbox.exe to run it. In the 'Paste Full Path of File to Delete' box, copy and paste this entry:

C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\sndcca.dat

Don't click any of the buttons though, instead please click on the Action menu and choose "Delete on Reboot". In the window that opens up, click on the File menu and choose "Add File". The file should show up in the window. Then repeat the process, this time adding:

C:\WINNT\Windows Update Setup Files\mfcole.exe

If that's successful you should have the two files listed. Then repeat so that these files appear in the list as well:

C:\WINNT\System32\hostx.exe
C:\WINNT\msagent\INTL\rundns.exe
C:\WINNT\msagent\cmdkb.exe
C:\WINNT\system32\COM\hardmain.exe
C:\WINNT\Fonts\mp3font.exe
C:\WINNT\Web\winad.exe
C:\WINNT\inf\accdns.exe
C:\WINNT\inf\accdns.exe rerun
C:\WINNT\system\vgaurl.exe ren

When they are all there (and double check!), in the same window choose the Action menu and select "Process and Reboot". You'll be prompted to reboot, do so.

CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!

Run Hijack This!
Click "Scan".
Then "check" the box to the left of these item(s):

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://searchmiracle.com/sp.php

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchmiracle.com/sp.php

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://websearch.drsnsrch.com/sidesearch.cgi?id=

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://websearch.drsnsrch.com/sidesearch.cgi?id=

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q=

R3 - URLSearchHook: IncrediFindBHO Class - {5D60FF48-95BE-4956-B4C6-6BB168A70310} - C:\PROGRA~1\INCRED~1\BHO\INCFIN~1.DLL (file missing)

O2 - BHO: Band Class - {01F44A8A-8C97-4325-A378-76E68DC4AB2E} - C:\WINNT\systb.dll

O2 - BHO: &EliteBar - {28CAEFF3-0F18-4036-B504-51D73BD81ABC} - C:\WINNT\EliteToolBar\EliteToolBar version 53.dll (file missing)

O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)

O4 - HKLM\..\Run: [alchem] C:\WINNT\alchem.exe

O4 - HKLM\..\Run: [Belt] C:\WINNT\Belt.exe

O4 - HKLM\..\Run: [mfcole] C:\WINNT\Windows Update Setup Files\mfcole.exe

O4 - HKLM\..\Run: [updater] C:\Program Files\Common files\updater\wupdater.exe

O4 - HKLM\..\Run: [Win Server Updt] C:\WINNT\wupdt.exe

O4 - HKLM\..\Run: [zekjrqhg] C:\WINNT\System32\qsqvlr.exe

O4 - HKLM\..\Run: [*mfcole] C:\WINNT\Windows Update Setup Files\mfcole.exe

O4 - HKLM\..\Run: [*rundns] C:\WINNT\msagent\INTL\rundns.exe

O4 - HKLM\..\Run: [Winspl] C:\WINNT\System32\winsplx.jpg

O4 - HKLM\..\Run: [*cmdkb] C:\WINNT\msagent\cmdkb.exe

O4 - HKLM\..\Run: [*hardmain] C:\WINNT\system32\COM\hardmain.exe

O4 - HKLM\..\Run: [*mp3font] C:\WINNT\Fonts\mp3font.exe

O4 - HKLM\..\Run: [*winad] C:\WINNT\Web\winad.exe

O4 - HKLM\..\Run: [*accdns] C:\WINNT\inf\accdns.exe

O4 - HKLM\..\Run: [7363528.exe] C:\WINNT\System32\7363528.exe

O4 - HKLM\..\RunOnce: [*accdns] C:\WINNT\inf\accdns.exe rerun

O4 - HKCU\..\Run: [drmstor] C:\WINNT\System32\drmstor.exe

O4 - HKCU\..\Run: [nvrsnl] C:\WINNT\System32\nvrsnl.exe

O4 - HKCU\..\Run: [IcqBeta] C:\WINNT\System32\webcamupdate.exe

O4 - HKCU\..\RunOnce: [*MS Setup] C:\WINNT\system\vgaurl.exe ren

O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm

O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm

O16 - DPF: Dialpad US Java Applet - http://www.dialpad.com/applet/src/vscp.cab

O16 - DPF: {00000000-d9e3-4bc6-a0bd-3d0ca4be5271} -

O16 - DPF: {00000012-890E-4AAC-AFD9-EFF6954A34DD} -

O16 - DPF: {018B7EC3-EECA-11D3-8E71-0000E82C6C0D} - http://www.adultcash.com/sdialer/instantaccess.exe

O16 - DPF: {E8EDB60C-951E-4130-93DC-FAF1AD25F8E7} (MoneyTree Dialer) - http://cdn.climaxbucks.com/internet-optimi…DistIOcrack.CAB

O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} (MetaStreamCtl Class) - http://components.metastream.com/MTSInstal…MetaStream3.cab

O16 - DPF: {1D0D9077-3798-49BB-9058-393499174D5D} - file://c:\counter.cab

Then click "Fix checked".

Reboot in "safe" mode.

Find and delete:

c:\program files\common files\updater <— FOLDER

c:\winnt\alchem.exe <— file

c:\winnt\belt.exe <— file

c:\winnt\systb.dll <— file

c:\winnt\system32\7363528.exe <— file

c:\winnt\system32\com\hardmain.exe <— file

c:\winnt\system32\drmstor.exe <— file

c:\winnt\system32\nvrsnl.exe <— file

c:\winnt\system32\qsqvlr.exe <— file

c:\winnt\system32\webcamupdate.exe <— file

c:\winnt\system32\winsplx.jpg <— file

c:\winnt\web\related.htm <— file

c:\winnt\web\winad.exe <— file

c:\winnt\windows update setup files\mfcole.exe <— file

c:\winnt\wupdt.exe <— file

Some malware files may be "hidden".
Be sure to show hidden files when looking for these file(s) and/or folder(s).

Reboot in normal mode and "copy/paste" a new log file into this thread. :)
Post #3
I purchased Aluris's Spy Eliminator software off the web. Should I run it first or do your suggestions first? Thanks for responding and I am sorry I did not get back to you sooner. I was out of town for the weekend. I am looking forward to getting this computer back where it needs to be. :D
Post #4
You might as well run it to see if you "got your money's worth". The fix I posted probably won't work now. You have a "Stopguard" infection (among other things). Every time you boot, the file names change (so the "fix" would have to change). Go ahead and run the program you bought, and post back here with a new log file. :)
Post #5
Hello Micah_6:8,

I decided to run your reccomindations first. Here is the log I just created after that.

Logfile of HijackThis v1.98.2
Scan saved at 9:46:48 PM, on 10/25/2004
Platform: Windows 2000 SP2 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\LEXBCES.EXE
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\LEXPPS.EXE
C:\WINNT\System32\cisvc.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\mnmsrvc.exe
C:\PROGRA~1\Navnt\navapsvc.exe
C:\PROGRA~1\Navnt\npssvc.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\System32\locator.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\tcpsvcs.exe
C:\WINNT\System32\snmp.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\mspmspsv.exe
D:\proe\flexlm\i486_nt\obj\lmgrd.exe
D:\proe\flexlm\i486_nt\obj\ptc_d.exe
C:\PROGRA~1\Navnt\alertsvc.exe
C:\WINNT\Explorer.EXE
C:\WINNT\System32\Promon.exe
C:\Program Files\Navnt\POPROXY.EXE
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINNT\loadqm.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINNT\Fonts\mcreg.exe
C:\Program Files\Navnt\navapw32.exe
C:\Program Files\Aluria Software\ASE\ASE Scheduler.exe
C:\Program Files\Common Files\Real\Update_OB\rnathchk.exe
C:\WINNT\explorer.exe
C:\HJT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.my.delleworks.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
O2 - BHO: CATLEvents Object - {55E301E5-BA44-4095-BB0B-14E0123CCF71} - C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\gercm.dat
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [Promon.exe] Promon.exe
O4 - HKLM\..\Run: [NPS Event Checker] C:\PROGRA~1\Navnt\npscheck.exe
O4 - HKLM\..\Run: [Norton eMail Protect] C:\Program Files\Navnt\POPROXY.EXE
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [CreateCD50] "C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe" -r
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe -osboot
O4 - HKLM\..\Run: [STOPzilla] "D:\Program Files\STOPzilla!\Stopzilla.exe" /autorun
O4 - HKLM\..\Run: [*mcreg] C:\WINNT\Fonts\mcreg.exe
O4 - HKLM\..\RunOnce: [*mcreg] C:\WINNT\Fonts\mcreg.exe rerun
O4 - HKCU\..\RunOnce: [*MS Setup] C:\WINNT\System32\bkinst.exe ren time:1098758751
O4 - Startup: ASE Scheduler.lnk = C:\Program Files\Aluria Software\ASE\ASE Scheduler.exe
O4 - Global Startup: Norton AntiVirus AutoProtect.lnk = C:\Program Files\Navnt\navapw32.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: Open Picture in &Microsoft PhotoDraw - res://C:\PROGRA~1\MICROS~3\Office\1033\phdintl.dll/phdContext.htm
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE
O12 - Plugin for .mid: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .TIF: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O16 - DPF: {1EEC3C99-7AA3-4F6E-B381-AF6942B51618} (pup.setup) - http://www.lazychestnuts.net/0015/ph/pup.CAB
O16 - DPF: {38578BF0-0ABB-11D3-9330-0080C6F796A1} (Create & Print ActiveX Plug-in) - http://www.imgag.com/cp/install/AxCtp.cab
O16 - DPF: {60F47E29-4A42-11D2-83ED-02608CA10990} (SmartLOOK CAD Viewer Control) - http://www.i-markinc.com/SmartLOOKX/SmartLOOKX.cab
O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} (AcDcToday Control) - file://E:\Program Files\AutoCAD 2000i\AcDcToday.ocx
O16 - DPF: {AA14C86B-DA22-4811-8186-BB496A299C5F} (Be Here TotalView Player ActiveX Control, Version 3.0) - http://www.premiereinteractive.com/behere/…eoViewer3_0.cab
O16 - DPF: {C6637286-300D-11D4-AE0A-0010830243BD} (InstaFred Control) - file://E:\Program Files\AutoCAD 2000i\InstFred.ocx
O16 - DPF: {CA034DCC-A580-4333-B52F-15F98C42E04C} (Downloader Class) - http://www.stopzilla.com/_download/Auto_Installer/dwnldr.cab
O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview Control) - file://E:\Program Files\AutoCAD 2000i\AcPreview.ocx
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://fdl.msn.com/public/chat/msnchat45.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{417BA027-7897-4000-8149-0778C8376543}: NameServer = 68.57.192.5,68.57.192.6
O17 - HKLM\System\CS1\Services\Tcpip\..\{417BA027-7897-4000-8149-0778C8376543}: NameServer = 68.57.192.5,68.57.192.6
O17 - HKLM\System\CS2\Services\Tcpip\..\{417BA027-7897-4000-8149-0778C8376543}: NameServer = 68.57.192.5,68.57.192.6
Post #6 last edited
The "Stopguard" infection still has a few remnants. But, that's to be expected if you've booted since I made the post.

Let's try it again, since you've just posted a fresh log. I've cured 3 people in a row with this fix. Let's see if we can make it 4 :thumbup:

Run Killbox.

In the 'Paste Full Path of File to Delete' box, copy and paste this entry:

C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\gercm.dat

Don't click any of the buttons though, instead please click on the Action menu and choose "Delete on Reboot". In the window that opens up, click on the File menu and choose "Add File". The file should show up in the window. Then repeat the process, this time adding:

C:\WINNT\Fonts\mcreg.exe

If that's successful you should have the two files listed. Then repeat so that these files appear in the list as well:

C:\WINNT\System32\hostx.exe
C:\WINNT\System32\bkinst.exe

When they are all there (and double check!), in the same window choose the Action menu and select "Process and Reboot". You'll be prompted to reboot, do so.

CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!

Run Hijack This!
Click "Scan".
Then "check" the box to the left of these item(s):

O2 - BHO: CATLEvents Object - {55E301E5-BA44-4095-BB0B-14E0123CCF71} - C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\gercm.dat

O4 - HKLM\..\Run: [*mcreg] C:\WINNT\Fonts\mcreg.exe

O4 - HKLM\..\RunOnce: [*mcreg] C:\WINNT\Fonts\mcreg.exe rerun

O4 - HKCU\..\RunOnce: [*MS Setup] C:\WINNT\System32\bkinst.exe ren time:1098758751

Then click "Fix checked".

Reboot in "safe" mode.

Delete all files in this folder:

C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP <— FOLDER

Reboot in normal mode and "copy/paste" a new log file into this thread. :)

If you have rebooted since posting the last log file, DO NOT run this fix because it won't work. Just post another log file.

Because this infection changes after each reboot, it is imperative you do not reboot between the time you post a log, and you try the "fix".

I am receiving email notification of your replies to this topic.

I check my mail regularly, so there shouldn't be more that a few hours delay from the time you post until I reply with an answer.
Post #7
Hi Micah,

I guess I am too impatient. Here is a log after I ran spy eliminator. I am not going to reboot until I check this this evening. Thanks for your patientence and support.

Logfile of HijackThis v1.98.2
Scan saved at 9:07:46 AM, on 10/26/2004
Platform: Windows 2000 SP2 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\LEXBCES.EXE
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\LEXPPS.EXE
C:\WINNT\System32\cisvc.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\mnmsrvc.exe
C:\PROGRA~1\Navnt\navapsvc.exe
C:\PROGRA~1\Navnt\npssvc.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\System32\locator.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\tcpsvcs.exe
C:\WINNT\System32\snmp.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\mspmspsv.exe
D:\proe\flexlm\i486_nt\obj\lmgrd.exe
D:\proe\flexlm\i486_nt\obj\ptc_d.exe
C:\PROGRA~1\Navnt\alertsvc.exe
C:\WINNT\Explorer.EXE
C:\WINNT\System32\Promon.exe
C:\Program Files\Navnt\POPROXY.EXE
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINNT\loadqm.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Navnt\navapw32.exe
C:\Program Files\Aluria Software\ASE\ASE Scheduler.exe
C:\WINNT\System32\cidaemon.exe
C:\WINNT\System32\cidaemon.exe
C:\WINNT\Fonts\mcreg.exe
C:\Program Files\Common Files\Real\Update_OB\rnathchk.exe
C:\HJT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.my.delleworks.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
O2 - BHO: CATLEvents Object - {55E301E5-BA44-4095-BB0B-14E0123CCF71} - C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\gercm.dat
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [Promon.exe] Promon.exe
O4 - HKLM\..\Run: [NPS Event Checker] C:\PROGRA~1\Navnt\npscheck.exe
O4 - HKLM\..\Run: [Norton eMail Protect] C:\Program Files\Navnt\POPROXY.EXE
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [CreateCD50] "C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe" -r
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe -osboot
O4 - HKLM\..\Run: [STOPzilla] "D:\Program Files\STOPzilla!\Stopzilla.exe" /autorun
O4 - HKLM\..\Run: [*mcreg] C:\WINNT\Fonts\mcreg.exe
O4 - HKLM\..\RunOnce: [*mcreg] C:\WINNT\Fonts\mcreg.exe rerun
O4 - HKCU\..\RunOnce: [*MS Setup] C:\WINNT\System32\bkinst.exe ren time:1098758751
O4 - Startup: ASE Scheduler.lnk = C:\Program Files\Aluria Software\ASE\ASE Scheduler.exe
O4 - Global Startup: Norton AntiVirus AutoProtect.lnk = C:\Program Files\Navnt\navapw32.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: Open Picture in &Microsoft PhotoDraw - res://C:\PROGRA~1\MICROS~3\Office\1033\phdintl.dll/phdContext.htm
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE
O12 - Plugin for .mid: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .TIF: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O16 - DPF: {38578BF0-0ABB-11D3-9330-0080C6F796A1} (Create & Print ActiveX Plug-in) - http://www.imgag.com/cp/install/AxCtp.cab
O16 - DPF: {60F47E29-4A42-11D2-83ED-02608CA10990} (SmartLOOK CAD Viewer Control) - http://www.i-markinc.com/SmartLOOKX/SmartLOOKX.cab
O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} (AcDcToday Control) - file://E:\Program Files\AutoCAD 2000i\AcDcToday.ocx
O16 - DPF: {AA14C86B-DA22-4811-8186-BB496A299C5F} (Be Here TotalView Player ActiveX Control, Version 3.0) - http://www.premiereinteractive.com/behere/…eoViewer3_0.cab
O16 - DPF: {C6637286-300D-11D4-AE0A-0010830243BD} (InstaFred Control) - file://E:\Program Files\AutoCAD 2000i\InstFred.ocx
O16 - DPF: {CA034DCC-A580-4333-B52F-15F98C42E04C} (Downloader Class) - http://www.stopzilla.com/_download/Auto_Installer/dwnldr.cab
O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview Control) - file://E:\Program Files\AutoCAD 2000i\AcPreview.ocx
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://fdl.msn.com/public/chat/msnchat45.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{417BA027-7897-4000-8149-0778C8376543}: NameServer = 68.57.192.5,68.57.192.6
O17 - HKLM\System\CS1\Services\Tcpip\..\{417BA027-7897-4000-8149-0778C8376543}: NameServer = 68.57.192.5,68.57.192.6
O17 - HKLM\System\CS2\Services\Tcpip\..\{417BA027-7897-4000-8149-0778C8376543}: NameServer = 68.57.192.5,68.57.192.6
Post #9
Thank you for your help Micah…. I did not run the last fix you posted but my computer seems to be running real good now. I am posting a fresh hijackthis log for you to view. My computer got turned off last nigh and I had to reboot. Hopefully, if there is anything you would like me to do I can do it before it gets turned off. Thanks again for your help.

Latest Log:

Logfile of HijackThis v1.98.2
Scan saved at 4:40:56 PM, on 10/27/2004
Platform: Windows 2000 SP2 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\LEXBCES.EXE
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\LEXPPS.EXE
C:\WINNT\System32\cisvc.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\mnmsrvc.exe
C:\PROGRA~1\Navnt\navapsvc.exe
C:\PROGRA~1\Navnt\npssvc.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\System32\locator.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\tcpsvcs.exe
C:\WINNT\System32\snmp.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\mspmspsv.exe
D:\proe\flexlm\i486_nt\obj\lmgrd.exe
D:\proe\flexlm\i486_nt\obj\ptc_d.exe
C:\PROGRA~1\Navnt\alertsvc.exe
C:\WINNT\Explorer.EXE
C:\WINNT\System32\Promon.exe
C:\Program Files\Navnt\POPROXY.EXE
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINNT\loadqm.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Navnt\navapw32.exe
C:\Program Files\Aluria Software\ASE\ASE Scheduler.exe
C:\WINNT\repair\diskjava.exe
C:\WINNT\System32\cidaemon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Real\Update_OB\rnathchk.exe
C:\WINNT\System32\cidaemon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\HJT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.my.delleworks.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
O2 - BHO: CATLEvents Object - {55E301E5-BA44-4095-BB0B-14E0123CCF71} - C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\avajksid.dat
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [Promon.exe] Promon.exe
O4 - HKLM\..\Run: [NPS Event Checker] C:\PROGRA~1\Navnt\npscheck.exe
O4 - HKLM\..\Run: [Norton eMail Protect] C:\Program Files\Navnt\POPROXY.EXE
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [CreateCD50] "C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe" -r
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe -osboot
O4 - HKLM\..\Run: [STOPzilla] "D:\Program Files\STOPzilla!\Stopzilla.exe" /autorun
O4 - HKLM\..\Run: [*mcreg] C:\WINNT\Fonts\mcreg.exe
O4 - HKLM\..\RunOnce: [*diskjava] C:\WINNT\repair\diskjava.exe rerun
O4 - HKCU\..\RunOnce: [*MS Setup] C:\WINNT\System32\bkinst.exe ren time:1098758751
O4 - Startup: ASE Scheduler.lnk = C:\Program Files\Aluria Software\ASE\ASE Scheduler.exe
O4 - Global Startup: Norton AntiVirus AutoProtect.lnk = C:\Program Files\Navnt\navapw32.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: Open Picture in &Microsoft PhotoDraw - res://C:\PROGRA~1\MICROS~3\Office\1033\phdintl.dll/phdContext.htm
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE
O12 - Plugin for .mid: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .TIF: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O16 - DPF: {38578BF0-0ABB-11D3-9330-0080C6F796A1} (Create & Print ActiveX Plug-in) - http://www.imgag.com/cp/install/AxCtp.cab
O16 - DPF: {60F47E29-4A42-11D2-83ED-02608CA10990} (SmartLOOK CAD Viewer Control) - http://www.i-markinc.com/SmartLOOKX/SmartLOOKX.cab
O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} (AcDcToday Control) - file://E:\Program Files\AutoCAD 2000i\AcDcToday.ocx
O16 - DPF: {AA14C86B-DA22-4811-8186-BB496A299C5F} (Be Here TotalView Player ActiveX Control, Version 3.0) - http://www.premiereinteractive.com/behere/…eoViewer3_0.cab
O16 - DPF: {C6637286-300D-11D4-AE0A-0010830243BD} (InstaFred Control) - file://E:\Program Files\AutoCAD 2000i\InstFred.ocx
O16 - DPF: {CA034DCC-A580-4333-B52F-15F98C42E04C} (Downloader Class) - http://www.stopzilla.com/_download/Auto_Installer/dwnldr.cab
O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview Control) - file://E:\Program Files\AutoCAD 2000i\AcPreview.ocx
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://fdl.msn.com/public/chat/msnchat45.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{417BA027-7897-4000-8149-0778C8376543}: NameServer = 68.57.192.5,68.57.192.6
O17 - HKLM\System\CS1\Services\Tcpip\..\{417BA027-7897-4000-8149-0778C8376543}: NameServer = 68.57.192.5,68.57.192.6
O17 - HKLM\System\CS2\Services\Tcpip\..\{417BA027-7897-4000-8149-0778C8376543}: NameServer = 68.57.192.5,68.57.192.6
Post #10
If you have rebooted since you posted the log, DO NOT ATTEMPT THIS FIX. Instead post another log file.

Run Killbox.

In the 'Paste Full Path of File to Delete' box, copy and paste this entry:

C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\avajksid.dat

Don't click any of the buttons though, instead please click on the Action menu and choose "Delete on Reboot". In the window that opens up, click on the File menu and choose "Add File". The file should show up in the window. Then repeat the process, this time adding:

C:\WINNT\Fonts\mcreg.exe

If that's successful you should have the two files listed. Then repeat so that these files appear in the list as well:

C:\WINNT\System32\hostx.exe
C:\WINNT\repair\diskjava.exe
C:\WINNT\System32\bkinst.exe

When they are all there (and double check!), in the same window choose the Action menu and select "Process and Reboot". You'll be prompted to reboot, do so.

CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!

Run Hijack This!
Click "Scan".
Then "check" the box to the left of these item(s):

O2 - BHO: CATLEvents Object - {55E301E5-BA44-4095-BB0B-14E0123CCF71} - C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\avajksid.dat

O4 - HKLM\..\Run: [*mcreg] C:\WINNT\Fonts\mcreg.exe

O4 - HKLM\..\RunOnce: [*diskjava] C:\WINNT\repair\diskjava.exe rerun

O4 - HKCU\..\RunOnce: [*MS Setup] C:\WINNT\System32\bkinst.exe ren time:1098758751

Then click "Fix checked".

Reboot in "safe" mode.

Delete all files in this folder:

c:\documents and settings\administrator\local settings\temp <— FOLDER

Reboot in normal mode and "copy/paste" a new log file into this thread. :)
Post #11
I think I am done Micah. Please let me know what you think.

Thanks again for all the help!

Logfile of HijackThis v1.98.2
Scan saved at 1:36:41 AM, on 10/28/2004
Platform: Windows 2000 SP2 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\LEXBCES.EXE
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\LEXPPS.EXE
C:\WINNT\System32\cisvc.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\mnmsrvc.exe
C:\PROGRA~1\Navnt\navapsvc.exe
C:\PROGRA~1\Navnt\npssvc.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\System32\locator.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\tcpsvcs.exe
C:\WINNT\System32\snmp.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\mspmspsv.exe
D:\proe\flexlm\i486_nt\obj\lmgrd.exe
D:\proe\flexlm\i486_nt\obj\ptc_d.exe
C:\PROGRA~1\Navnt\alertsvc.exe
C:\WINNT\System32\cidaemon.exe
C:\WINNT\System32\cidaemon.exe
C:\WINNT\Explorer.EXE
C:\WINNT\System32\Promon.exe
C:\Program Files\Navnt\POPROXY.EXE
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINNT\loadqm.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Navnt\navapw32.exe
C:\Program Files\Aluria Software\ASE\ASE Scheduler.exe
C:\Program Files\Common Files\Real\Update_OB\rnathchk.exe
C:\HJT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.my.delleworks.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [Promon.exe] Promon.exe
O4 - HKLM\..\Run: [NPS Event Checker] C:\PROGRA~1\Navnt\npscheck.exe
O4 - HKLM\..\Run: [Norton eMail Protect] C:\Program Files\Navnt\POPROXY.EXE
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [CreateCD50] "C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe" -r
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe -osboot
O4 - HKLM\..\Run: [STOPzilla] "D:\Program Files\STOPzilla!\Stopzilla.exe" /autorun
O4 - Startup: ASE Scheduler.lnk = C:\Program Files\Aluria Software\ASE\ASE Scheduler.exe
O4 - Global Startup: Norton AntiVirus AutoProtect.lnk = C:\Program Files\Navnt\navapw32.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: Open Picture in &Microsoft PhotoDraw - res://C:\PROGRA~1\MICROS~3\Office\1033\phdintl.dll/phdContext.htm
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE
O12 - Plugin for .mid: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .TIF: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O16 - DPF: {38578BF0-0ABB-11D3-9330-0080C6F796A1} (Create & Print ActiveX Plug-in) - http://www.imgag.com/cp/install/AxCtp.cab
O16 - DPF: {60F47E29-4A42-11D2-83ED-02608CA10990} (SmartLOOK CAD Viewer Control) - http://www.i-markinc.com/SmartLOOKX/SmartLOOKX.cab
O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} (AcDcToday Control) - file://E:\Program Files\AutoCAD 2000i\AcDcToday.ocx
O16 - DPF: {AA14C86B-DA22-4811-8186-BB496A299C5F} (Be Here TotalView Player ActiveX Control, Version 3.0) - http://www.premiereinteractive.com/behere/…eoViewer3_0.cab
O16 - DPF: {C6637286-300D-11D4-AE0A-0010830243BD} (InstaFred Control) - file://E:\Program Files\AutoCAD 2000i\InstFred.ocx
O16 - DPF: {CA034DCC-A580-4333-B52F-15F98C42E04C} (Downloader Class) - http://www.stopzilla.com/_download/Auto_Installer/dwnldr.cab
O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview Control) - file://E:\Program Files\AutoCAD 2000i\AcPreview.ocx
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://fdl.msn.com/public/chat/msnchat45.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{417BA027-7897-4000-8149-0778C8376543}: NameServer = 68.57.192.5,68.57.192.6
O17 - HKLM\System\CS1\Services\Tcpip\..\{417BA027-7897-4000-8149-0778C8376543}: NameServer = 68.57.192.5,68.57.192.6
O17 - HKLM\System\CS2\Services\Tcpip\..\{417BA027-7897-4000-8149-0778C8376543}: NameServer = 68.57.192.5,68.57.192.6
Post #12
WOO HOO!!!!!

Stop guard is finally deceased!!!!!

Log is clean now!!!!

GOD bless!!!!

M68 :)

Items you may wish to consider to harden your defenses against future infections:

Read "How did I get infected in the first place?" here:

http://boards.cexx.org/viewtopic.php?t=957

Download IE-Spyad here:

https://netfiles.uiuc.edu/ehowes/www/resource.htm

IE-Spyad puts over 4000 known malicious web sites into IE's "restricted zone" to help prevent you from getting infected.

Check your browser settings here:

http://browsercheck.qualys.com/index.php

A series of "tests" (and suggested fixes) to help tweak IE's settings to help prevent infections when surfing the web.

Follow safe Internet practices:

1. Keep your virus definitions up to date, and scan your system regularly.

2. Don't open email, or download attachments from unrecognized email addresses.

3. Be careful when downloading email attachments, EVEN FROM PEOPLE YOU KNOW! Many virii, worms, and trojans infect a persons system then immeadiately spread themselves to the people in the infected persons addressbook via email attachments.

4. Be careful downloading files from the Internet. Scan all downloaded files with a reliable UP-TO-DATE antivirus program. Scan "zip" files BEFORE unzipping, and scan all unzipped files BEFORE USING THEM.

5. Keep your Windows and IE current with all the latest patches and updates.

Post #13
This topic is now closed.

If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.

If this is not your thread please start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI