What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Multiple Bogus Processes At Start-up

1 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
My parent's PC has slowed to a crawl - when they boot up, almost
30 processes start running, then (after 10 minutes of hard drive chatter),
they go away - at least, they don't show up in the process list. Problems
still abound, though. I've used filemon and found a couple different
processes (msvcip, keymsvc) writing a TMP file constantly to the hard drive.
The HJT log is below - I know alot of the O4's are the bogus processes,
but I'm not sure what to keep.

I've done Adaware and Spybot, but that didn't seem to help. I'm having
them do the Symantec online virus scan (long story), but I don't know the
results yet. Any ideas about how all of those processes could've gotten
stuck in their registry?

Thanks!

—-

Logfile of HijackThis v1.98.2
Scan saved at 6:22:32 PM, on 12/1/2004
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\SSDPSRV.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\NETROPA\ONE-TOUCH MULTIMEDIA KEYBOARD\MMKEYBD.EXE
C:\WINDOWS\SYSTEM\HPSYSDRV.EXE
C:\WINDOWS\DELAYRUN.EXE
C:\PROGRAM FILES\MOVIE MAKER\HP SHARE-TO-WEB\HPGS2WND.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\PROGRAM FILES\MSN APPS\UPDATER\01.02.3000.1001\EN-US\MSNAPPAU.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\RNATHCHK.EXE
C:\PROGRAM FILES\NETROPA\ONE-TOUCH MULTIMEDIA KEYBOARD\KEYBDMGR.EXE
C:\PROGRAM FILES\NETROPA\ONSCREEN DISPLAY\OSD.EXE
C:\PROGRAM FILES\MOVIE MAKER\HP SHARE-TO-WEB\HPGS2WNF.EXE
C:\WINDOWS\APPPATCH\KEYMSVC.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\RunDLL.exe
C:\PROGRAM FILES\NETROPA\ONE-TOUCH MULTIMEDIA KEYBOARD\MMUSBKB2.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\MY DOCUMENTS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.com/0SEENUS/SAOS01
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.yahoo.com/search/ie.html
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\PROGRAM FILES\MSN APPS\MSN TOOLBAR\01.02.3000.1001\EN-US\MSNTB.DLL
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\PROGRAM FILES\MSN APPS\ST\01.02.3000.1002\EN-XU\STMAIN.DLL
O2 - BHO: CATLEvents Object - {60112085-E1CE-4e0e-823A-EBB1AD98804C} - C:\WINDOWS\TEMP\LLDTNOF.DAT
O2 - BHO: CATLEvents Object - {F32F8ECD-6CF3-459D-82F2-9738392C85A8} - C:\WINDOWS\TEMP\LLDTNOF.DAT
O2 - BHO: CATLEvents Object - {C69FA570-7FDE-4C49-A7BC-CB1CF24BE66B} - C:\WINDOWS\TEMP\IPATSMW.DAT
O2 - BHO: CATLEvents Object - {73529697-D46A-4F7D-8A93-01378FCAEDA4} - C:\WINDOWS\TEMP\SACCA.DAT
O2 - BHO: CATLEvents Object - {870B70D4-F6DA-47AE-9158-D146440A0A4D} - C:\WINDOWS\TEMP\DMCOFNI.DAT
O2 - BHO: CATLEvents Object - {6A06CDAD-9D2D-42A0-9C91-C0CF7CB9971B} - C:\WINDOWS\TEMP\YALPRBA.DAT
O2 - BHO: CATLEvents Object - {ED5ABC42-8E4F-4C39-9972-F0CF619D672F} - C:\WINDOWS\TEMP\CVSMYEK.DAT
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\PROGRAM FILES\MSN APPS\MSN TOOLBAR\01.02.3000.1001\EN-US\MSNTB.DLL
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [Keyboard Manager] C:\Program Files\Netropa\One-touch Multimedia Keyboard\MMKeybd.exe
O4 - HKLM\..\Run: [HPScanPatch] C:\WINDOWS\SYSTEM\HPScanFix.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [Delay] C:\WINDOWS\delayrun.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Movie Maker\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe -osboot
O4 - HKLM\..\Run: [SysUpd] C:\WINDOWS\SYSUPD.EXE
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-us\msnappau.exe"
O4 - HKLM\..\Run: [*FONTDLL] C:\WINDOWS\FONTS\FONTDLL.EXE
O4 - HKLM\..\Run: [DRVAD] C:\WINDOWS\HELP\DRVAD.EXE
O4 - HKLM\..\Run: [*DRVAD] C:\WINDOWS\HELP\DRVAD.EXE
O4 - HKLM\..\Run: [*SJAVA] C:\WINDOWS\FONTS\SJAVA.EXE
O4 - HKLM\..\Run: [JAVAIIS] C:\WINDOWS\TASKS\JAVAIIS.EXE
O4 - HKLM\..\Run: [*TASKMS] C:\WINDOWS\CONFIG\TASKMS.EXE
O4 - HKLM\..\Run: [*BAKINET] C:\WINDOWS\FONTS\BAKINET.EXE
O4 - HKLM\..\Run: C:\WINDOWS\SYSTEM\VMM32\IMG.EXE
O4 - HKLM\..\Run: [*INFOAP] C:\WINDOWS\HELP\INFOAP.EXE
O4 - HKLM\..\Run: [ADDRV] C:\WINDOWS\WEB\ADDRV.EXE
O4 - HKLM\..\Run: [DISKMFC] C:\WINDOWS\SYSTEM32\DISKMFC.EXE
O4 - HKLM\..\Run: [*NUT] C:\WINDOWS\CURSORS\NUT.EXE
O4 - HKLM\..\Run: [*CABEXP] C:\WINDOWS\CONFIG\CABEXP.EXE
O4 - HKLM\..\Run: [*DISKNET] C:\WINDOWS\DISKNET.EXE
O4 - HKLM\..\Run: [*RASOLE] C:\WINDOWS\JAVA\RASOLE.EXE
O4 - HKLM\..\Run: [*DVDNUT] C:\WINDOWS\SYSTEM\COLOR\DVDNUT.EXE
O4 - HKLM\..\Run: [*XMLWAVE] C:\WINDOWS\CONFIG\XMLWAVE.EXE
O4 - HKLM\..\Run: [*ACCIIS] C:\WINDOWS\WEB\ACCIIS.EXE
O4 - HKLM\..\Run: [*RASMS] C:\WINDOWS\CONFIG\RASMS.EXE
O4 - HKLM\..\Run: [*APBAS] C:\WINDOWS\TASKS\APBAS.EXE
O4 - HKLM\..\Run: [*ODBCOLE] C:\WINDOWS\APPPATCH\ODBCOLE.EXE
O4 - HKLM\..\Run: [*BINTAPI] C:\WINDOWS\APPPATCH\BINTAPI.EXE
O4 - HKLM\..\Run: [*AD] C:\WINDOWS\TASKS\AD.EXE
O4 - HKLM\..\Run: [*INETIP] C:\WINDOWS\FONTS\INETIP.EXE
O4 - HKLM\..\Run: [*DRVPC] C:\WINDOWS\SYSTEM\IOSUBSYS\DRVPC.EXE
O4 - HKLM\..\Run: [*RASFAX] C:\WINDOWS\WEB\RASFAX.EXE
O4 - HKLM\..\Run: [*VGAAS] C:\WINDOWS\APPPATCH\VGAAS.EXE
O4 - HKLM\..\Run: [*KEYMAIN] C:\WINDOWS\WEB\KEYMAIN.EXE
O4 - HKLM\..\Run: [*DOCVSS] C:\WINDOWS\INF\DOCVSS.EXE
O4 - HKLM\..\Run: [*TCPVGA] C:\WINDOWS\SYSTEM32\TCPVGA.EXE
O4 - HKLM\..\Run: [*ADWIN] C:\WINDOWS\SYSTEM\MACROMED\FLASH\ADWIN.EXE
O4 - HKLM\..\Run: [*ACRAS] C:\WINDOWS\TASKS\ACRAS.EXE
O4 - HKLM\..\Run: [IPODBC] C:\WINDOWS\WEB\IPODBC.EXE
O4 - HKLM\..\Run: [*RASANTI] C:\WINDOWS\INF\CATALOG\RASANTI.EXE
O4 - HKLM\..\Run: [PCXML] C:\WINDOWS\WEB\PCXML.EXE
O4 - HKLM\..\Run: [*MCREG] C:\WINDOWS\APPPATCH\MCREG.EXE
O4 - HKLM\..\Run: [*CDVD] C:\WINDOWS\WINDOWS UPDATE SETUP FILES\CDVD.EXE
O4 - HKLM\..\Run: [CRLIB] C:\WINDOWS\WINDOWS UPDATE SETUP FILES\CRLIB.EXE
O4 - HKLM\..\Run: [*PCMC] C:\WINDOWS\WEB\PCMC.EXE
O4 - HKLM\..\Run: [*JAVAPC] C:\WINDOWS\WINDOWS UPDATE SETUP FILES\JAVAPC.EXE
O4 - HKLM\..\Run: [WINC] C:\WINDOWS\WINDOWS UPDATE SETUP FILES\WINC.EXE
O4 - HKLM\..\Run: [*FONTPLAY] C:\WINDOWS\FONTPLAY.EXE
O4 - HKLM\..\Run: [*DVDCAB] C:\WINDOWS\SYSTEM32\DVDCAB.EXE
O4 - HKLM\..\Run: [*BAK] C:\WINDOWS\TASKS\BAK.EXE
O4 - HKLM\..\Run: [*EXPBIN] C:\WINDOWS\JAVA\CLASSES\EXPBIN.EXE
O4 - HKLM\..\Run: [*VGAINET] C:\WINDOWS\FONTS\VGAINET.EXE
O4 - HKLM\..\Run: [*REGBIN] C:\WINDOWS\JAVA\REGBIN.EXE
O4 - HKLM\..\Run: [*BAKDISK] C:\WINDOWS\HELP\MIT\BAKDISK.EXE
O4 - HKLM\..\Run: [*FTPUTIL] C:\WINDOWS\FTPUTIL.EXE
O4 - HKLM\..\Run: [*EULABAK] C:\WINDOWS\HELP\KB\EULABAK.EXE
O4 - HKLM\..\Run: [*ASMSVC] C:\WINDOWS\CURSORS\ASMSVC.EXE
O4 - HKLM\..\Run: [*EXPLIB] C:\WINDOWS\CONFIG\EXPLIB.EXE
O4 - HKLM\..\Run: [*WAVECR] C:\WINDOWS\CONFIG\WAVECR.EXE
O4 - HKLM\..\Run: [*JAVAUTIL] C:\WINDOWS\HELP\KB\JAVAUTIL.EXE
O4 - HKLM\..\Run: [*CATTAPI] C:\WINDOWS\CURSORS\CATTAPI.EXE
O4 - HKLM\..\Run: [*WAVEBIN] C:\WINDOWS\WINDOWS UPDATE SETUP FILES\WAVEBIN.EXE
O4 - HKLM\..\Run: [*MCRAS] C:\WINDOWS\WEB\MCRAS.EXE
O4 - HKLM\..\Run: [*BASFTP] C:\WINDOWS\HELP\MIT\BASFTP.EXE
O4 - HKLM\..\Run: [*TCPHARD] C:\WINDOWS\CONFIG\TCPHARD.EXE
O4 - HKLM\..\Run: [*REGHARD] C:\WINDOWS\WEB\REGHARD.EXE
O4 - HKLM\..\Run: [*APCR] C:\WINDOWS\TASKS\APCR.EXE
O4 - HKLM\..\Run: [*ODBCCR] C:\WINDOWS\SYSTEM\ODBCCR.EXE
O4 - HKLM\..\Run: [*ASWAVE] C:\WINDOWS\CONFIG\ASWAVE.EXE
O4 - HKLM\..\Run: [*UTILVB] C:\WINDOWS\APPPATCH\UTILVB.EXE
O4 - HKLM\..\Run: [*ACCAS] C:\WINDOWS\INF\ACCAS.EXE
O4 - HKLM\..\Run: [*SMAIN] C:\WINDOWS\JAVA\TRUSTLIB\SMAIN.EXE
O4 - HKLM\..\Run: [*BAKFTP] C:\WINDOWS\SYSTEM\WBEM\BAKFTP.EXE
O4 - HKLM\..\Run: [*FONTIMG] C:\WINDOWS\FONTIMG.EXE
O4 - HKLM\..\Run: [*INFOURL] C:\WINDOWS\HELP\MIT\INFOURL.EXE
O4 - HKLM\..\Run: [*PSAP] C:\WINDOWS\CURSORS\PSAP.EXE
O4 - HKLM\..\Run: [*ABRPLAY] C:\WINDOWS\TASKS\ABRPLAY.EXE
O4 - HKLM\..\Run: [*VBWAVE] C:\WINDOWS\HELP\VBWAVE.EXE
O4 - HKLM\..\Run: [*FONTWEB] C:\WINDOWS\HELP\MIT\FONTWEB.EXE
O4 - HKLM\..\Run: [*ADFONT] C:\WINDOWS\JAVA\CLASSES\ADFONT.EXE
O4 - HKLM\..\Run: [*FAXTAPI] C:\WINDOWS\CONFIG\FAXTAPI.EXE
O4 - HKLM\..\Run: [*MSVCIP] C:\WINDOWS\SYSTEM\WBEM\MSVCIP.EXE
O4 - HKLM\..\Run: [*INFOCMD] C:\WINDOWS\CONFIG\INFOCMD.EXE
O4 - HKLM\..\Run: [*FONTDOC] C:\WINDOWS\CONFIG\FONTDOC.EXE
O4 - HKLM\..\Run: [*FAXDB] C:\WINDOWS\WINDOWS UPDATE SETUP FILES\FAXDB.EXE
O4 - HKLM\..\Run: [*PLAYAD] C:\WINDOWS\SYSTEM\SFP\TEMPCATS\PLAYAD.EXE
O4 - HKLM\..\Run: [*IMGKB] C:\WINDOWS\SYSTEM\CATROOT\IMGKB.EXE
O4 - HKLM\..\Run: [*UNS] C:\WINDOWS\APPPATCH\UNS.EXE
O4 - HKLM\..\Run: [*AVAD] C:\WINDOWS\APPPATCH\AVAD.EXE
O4 - HKLM\..\Run: [*CLOG] C:\WINDOWS\CLOG.EXE
O4 - HKLM\..\Run: [*HARDTCP] C:\WINDOWS\HARDTCP.EXE
O4 - HKLM\..\Run: [*KEYMSVC] C:\WINDOWS\APPPATCH\KEYMSVC.EXE
O4 - HKLM\..\Run: [*LIBC] C:\WINDOWS\TASKS\LIBC.EXE
O4 - HKLM\..\Run: [*KBLOG] C:\WINDOWS\CONFIG\KBLOG.EXE
O4 - HKLM\..\Run: [*LIBOLE] C:\WINDOWS\INF\QFE\LIBOLE.EXE
O4 - HKLM\..\Run: [*ADRAS] C:\WINDOWS\SYSTEM\SHELLNEW\ADRAS.EXE
O4 - HKLM\..\Run: [*ABRMSVC] C:\WINDOWS\INF\ABRMSVC.EXE
O4 - HKLM\..\Run: [*CVGA] C:\WINDOWS\MSAGENT\CHARS\CVGA.EXE
O4 - HKLM\..\Run: [*dosac] C:\WINDOWS\MSAGENT\CHARS\DOSAC.EXE
O4 - HKLM\..\Run: [*maintask] C:\WINDOWS\MAINTASK.EXE
O4 - HKLM\..\Run: [*antic] C:\WINDOWS\APPPATCH\ANTIC.EXE
O4 - HKLM\..\Run: [*olejava] C:\WINDOWS\MSAGENT\OLEJAVA.EXE
O4 - HKLM\..\Run: [*infotapi] C:\WINDOWS\CONFIG\INFOTAPI.EXE
O4 - HKLM\..\Run: [*ipdrv] C:\WINDOWS\SYSTEM\COLOR\IPDRV.EXE
O4 - HKLM\..\Run: [*wmstapi] C:\WINDOWS\JAVA\TRUSTLIB\WMSTAPI.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [SSDPSRV] C:\WINDOWS\SYSTEM\ssdpsrv.exe
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\RunOnce: [*KEYMSVC] C:\WINDOWS\APPPATCH\KEYMSVC.EXE rerun
O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: MSN Messenger Service - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O16 - DPF: {9DBAFCCF-592F-FFFF-FFFF-00608CEC297C} - http://download.weatherbug.com/minibug/tri…uginstaller.cab
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IMDownloader Class) - http://www2.incredimail.com/contents/setup…er/imloader.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://imgfarm.com/images/nocache/funwebpr…etup1.0.0.8.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} (MetaStreamCtl Class) - https://components.viewpoint.com/MTSInstall…215C4ECF918}096
Post #2 last edited
Greetings and welcome to TomCoyote.org!

You have a "Stopguard" infection. Please do not reboot until told to do so. Each reboot can make the infection harder to remove.

If you have rebooted since you posted the log, DO NOT ATTEMPT THIS FIX. Instead post another log file and leave your machine on.

Download Killbox.zip

Extract it from the zip file then double-click on Killbox.exe to run it. In the 'Paste Full Path of File to Delete' box, copy and paste this entry:

C:\WINDOWS\APPPATCH\ANTIC.EXE

Don't click any of the buttons though, instead please click on the Action menu and choose "Delete on Reboot". In the window that opens up, click on the File menu and choose "Add File". The file should show up in the window. Then repeat the process, this time adding:

C:\WINDOWS\APPPATCH\AVAD.EXE

If that's successful you should have the two files listed. Then repeat so that these files appear in the list as well:

C:\WINDOWS\APPPATCH\BINTAPI.EXE
C:\WINDOWS\APPPATCH\KEYMSVC.EXE
C:\WINDOWS\APPPATCH\MCREG.EXE
C:\WINDOWS\APPPATCH\ODBCOLE.EXE
C:\WINDOWS\APPPATCH\UNS.EXE
C:\WINDOWS\APPPATCH\UTILVB.EXE
C:\WINDOWS\APPPATCH\VGAAS.EXE
C:\WINDOWS\CLOG.EXE
C:\WINDOWS\CONFIG\ASWAVE.EXE
C:\WINDOWS\CONFIG\CABEXP.EXE
C:\WINDOWS\CONFIG\EXPLIB.EXE
C:\WINDOWS\CONFIG\FAXTAPI.EXE
C:\WINDOWS\CONFIG\FONTDOC.EXE
C:\WINDOWS\CONFIG\INFOCMD.EXE
C:\WINDOWS\CONFIG\INFOTAPI.EXE
C:\WINDOWS\CONFIG\KBLOG.EXE
C:\WINDOWS\CONFIG\RASMS.EXE
C:\WINDOWS\CONFIG\TASKMS.EXE
C:\WINDOWS\CONFIG\TCPHARD.EXE
C:\WINDOWS\CONFIG\WAVECR.EXE
C:\WINDOWS\CONFIG\XMLWAVE.EXE
C:\WINDOWS\CURSORS\ASMSVC.EXE
C:\WINDOWS\CURSORS\CATTAPI.EXE
C:\WINDOWS\CURSORS\NUT.EXE
C:\WINDOWS\CURSORS\PSAP.EXE
C:\WINDOWS\DISKNET.EXE
C:\WINDOWS\FONTIMG.EXE
C:\WINDOWS\FONTPLAY.EXE
C:\WINDOWS\FONTS\BAKINET.EXE
C:\WINDOWS\FONTS\FONTDLL.EXE
C:\WINDOWS\FONTS\INETIP.EXE
C:\WINDOWS\FONTS\SJAVA.EXE
C:\WINDOWS\FONTS\VGAINET.EXE
C:\WINDOWS\FTPUTIL.EXE
C:\WINDOWS\HARDTCP.EXE
C:\WINDOWS\HELP\DRVAD.EXE
C:\WINDOWS\HELP\INFOAP.EXE
C:\WINDOWS\HELP\KB\EULABAK.EXE
C:\WINDOWS\HELP\KB\JAVAUTIL.EXE
C:\WINDOWS\HELP\MIT\BAKDISK.EXE
C:\WINDOWS\HELP\MIT\BASFTP.EXE
C:\WINDOWS\HELP\MIT\FONTWEB.EXE
C:\WINDOWS\HELP\MIT\INFOURL.EXE
C:\WINDOWS\HELP\VBWAVE.EXE
C:\WINDOWS\INF\ABRMSVC.EXE
C:\WINDOWS\INF\ACCAS.EXE
C:\WINDOWS\INF\CATALOG\RASANTI.EXE
C:\WINDOWS\INF\DOCVSS.EXE
C:\WINDOWS\INF\QFE\LIBOLE.EXE
C:\WINDOWS\JAVA\CLASSES\ADFONT.EXE
C:\WINDOWS\JAVA\CLASSES\EXPBIN.EXE
C:\WINDOWS\JAVA\RASOLE.EXE
C:\WINDOWS\JAVA\REGBIN.EXE
C:\WINDOWS\JAVA\TRUSTLIB\SMAIN.EXE
C:\WINDOWS\JAVA\TRUSTLIB\WMSTAPI.EXE
C:\WINDOWS\MAINTASK.EXE
C:\WINDOWS\MSAGENT\CHARS\CVGA.EXE
C:\WINDOWS\MSAGENT\CHARS\DOSAC.EXE
C:\WINDOWS\MSAGENT\OLEJAVA.EXE
C:\WINDOWS\SYSTEM\CATROOT\IMGKB.EXE
C:\WINDOWS\SYSTEM\COLOR\DVDNUT.EXE
C:\WINDOWS\SYSTEM\COLOR\IPDRV.EXE
C:\WINDOWS\SYSTEM\IOSUBSYS\DRVPC.EXE
C:\WINDOWS\SYSTEM\MACROMED\FLASH\ADWIN.EXE
C:\WINDOWS\SYSTEM\ODBCCR.EXE
C:\WINDOWS\SYSTEM\SFP\TEMPCATS\PLAYAD.EXE
C:\WINDOWS\SYSTEM\SHELLNEW\ADRAS.EXE
C:\WINDOWS\SYSTEM\VMM32\IMG.EXE
C:\WINDOWS\SYSTEM\WBEM\BAKFTP.EXE
C:\WINDOWS\SYSTEM\WBEM\MSVCIP.EXE
C:\WINDOWS\SYSTEM32\DISKMFC.EXE
C:\WINDOWS\SYSTEM32\DVDCAB.EXE
C:\WINDOWS\SYSTEM32\TCPVGA.EXE
C:\WINDOWS\SYSUPD.EXE
C:\WINDOWS\TASKS\ABRPLAY.EXE
C:\WINDOWS\TASKS\ACRAS.EXE
C:\WINDOWS\TASKS\AD.EXE
C:\WINDOWS\TASKS\APBAS.EXE
C:\WINDOWS\TASKS\APCR.EXE
C:\WINDOWS\TASKS\BAK.EXE
C:\WINDOWS\TASKS\JAVAIIS.EXE
C:\WINDOWS\TASKS\LIBC.EXE
C:\WINDOWS\TEMP\CVSMYEK.DAT
C:\WINDOWS\TEMP\DMCOFNI.DAT
C:\WINDOWS\TEMP\IPATSMW.DAT
C:\WINDOWS\TEMP\LLDTNOF.DAT
C:\WINDOWS\TEMP\SACCA.DAT
C:\WINDOWS\TEMP\YALPRBA.DAT
C:\WINDOWS\WEB\ACCIIS.EXE
C:\WINDOWS\WEB\ADDRV.EXE
C:\WINDOWS\WEB\IPODBC.EXE
C:\WINDOWS\WEB\KEYMAIN.EXE
C:\WINDOWS\WEB\MCRAS.EXE
C:\WINDOWS\WEB\PCMC.EXE
C:\WINDOWS\WEB\PCXML.EXE
C:\WINDOWS\WEB\RASFAX.EXE
C:\WINDOWS\WEB\REGHARD.EXE
C:\WINDOWS\WINDOWS UPDATE SETUP FILES\CDVD.EXE
C:\WINDOWS\WINDOWS UPDATE SETUP FILES\CRLIB.EXE
C:\WINDOWS\WINDOWS UPDATE SETUP FILES\FAXDB.EXE
C:\WINDOWS\WINDOWS UPDATE SETUP FILES\JAVAPC.EXE
C:\WINDOWS\WINDOWS UPDATE SETUP FILES\WAVEBIN.EXE
C:\WINDOWS\WINDOWS UPDATE SETUP FILES\WINC.EXE
C:\WINDOWS\SYSTEM32\HOSTX.EXE

When they are all there (and double check!), in the same window choose the Action menu and select "Process and Reboot". You'll be prompted to reboot, do so.

CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!

Run Hijack This!
Click "Scan".
Then "check" the box to the left of these item(s):

O2 - BHO: CATLEvents Object - {60112085-E1CE-4e0e-823A-EBB1AD98804C} - C:\WINDOWS\TEMP\LLDTNOF.DAT

O2 - BHO: CATLEvents Object - {F32F8ECD-6CF3-459D-82F2-9738392C85A8} - C:\WINDOWS\TEMP\LLDTNOF.DAT

O2 - BHO: CATLEvents Object - {C69FA570-7FDE-4C49-A7BC-CB1CF24BE66B} - C:\WINDOWS\TEMP\IPATSMW.DAT

O2 - BHO: CATLEvents Object - {73529697-D46A-4F7D-8A93-01378FCAEDA4} - C:\WINDOWS\TEMP\SACCA.DAT

O2 - BHO: CATLEvents Object - {870B70D4-F6DA-47AE-9158-D146440A0A4D} - C:\WINDOWS\TEMP\DMCOFNI.DAT

O2 - BHO: CATLEvents Object - {6A06CDAD-9D2D-42A0-9C91-C0CF7CB9971B} - C:\WINDOWS\TEMP\YALPRBA.DAT

O2 - BHO: CATLEvents Object - {ED5ABC42-8E4F-4C39-9972-F0CF619D672F} - C:\WINDOWS\TEMP\CVSMYEK.DAT

O4 - HKLM\..\Run: [SysUpd] C:\WINDOWS\SYSUPD.EXE

O4 - HKLM\..\Run: [*FONTDLL] C:\WINDOWS\FONTS\FONTDLL.EXE

O4 - HKLM\..\Run: [DRVAD] C:\WINDOWS\HELP\DRVAD.EXE

O4 - HKLM\..\Run: [*DRVAD] C:\WINDOWS\HELP\DRVAD.EXE

O4 - HKLM\..\Run: [*SJAVA] C:\WINDOWS\FONTS\SJAVA.EXE

O4 - HKLM\..\Run: [JAVAIIS] C:\WINDOWS\TASKS\JAVAIIS.EXE

O4 - HKLM\..\Run: [*TASKMS] C:\WINDOWS\CONFIG\TASKMS.EXE

O4 - HKLM\..\Run: [*BAKINET] C:\WINDOWS\FONTS\BAKINET.EXE

O4 - HKLM\..\Run: C:\WINDOWS\SYSTEM\VMM32\IMG.EXE

O4 - HKLM\..\Run: [*INFOAP] C:\WINDOWS\HELP\INFOAP.EXE

O4 - HKLM\..\Run: [ADDRV] C:\WINDOWS\WEB\ADDRV.EXE

O4 - HKLM\..\Run: [DISKMFC] C:\WINDOWS\SYSTEM32\DISKMFC.EXE

O4 - HKLM\..\Run: [*NUT] C:\WINDOWS\CURSORS\NUT.EXE

O4 - HKLM\..\Run: [*CABEXP] C:\WINDOWS\CONFIG\CABEXP.EXE

O4 - HKLM\..\Run: [*DISKNET] C:\WINDOWS\DISKNET.EXE

O4 - HKLM\..\Run: [*RASOLE] C:\WINDOWS\JAVA\RASOLE.EXE

O4 - HKLM\..\Run: [*DVDNUT] C:\WINDOWS\SYSTEM\COLOR\DVDNUT.EXE

O4 - HKLM\..\Run: [*XMLWAVE] C:\WINDOWS\CONFIG\XMLWAVE.EXE

O4 - HKLM\..\Run: [*ACCIIS] C:\WINDOWS\WEB\ACCIIS.EXE

O4 - HKLM\..\Run: [*RASMS] C:\WINDOWS\CONFIG\RASMS.EXE

O4 - HKLM\..\Run: [*APBAS] C:\WINDOWS\TASKS\APBAS.EXE

O4 - HKLM\..\Run: [*ODBCOLE] C:\WINDOWS\APPPATCH\ODBCOLE.EXE

O4 - HKLM\..\Run: [*BINTAPI] C:\WINDOWS\APPPATCH\BINTAPI.EXE

O4 - HKLM\..\Run: [*AD] C:\WINDOWS\TASKS\AD.EXE

O4 - HKLM\..\Run: [*INETIP] C:\WINDOWS\FONTS\INETIP.EXE

O4 - HKLM\..\Run: [*DRVPC] C:\WINDOWS\SYSTEM\IOSUBSYS\DRVPC.EXE

O4 - HKLM\..\Run: [*RASFAX] C:\WINDOWS\WEB\RASFAX.EXE

O4 - HKLM\..\Run: [*VGAAS] C:\WINDOWS\APPPATCH\VGAAS.EXE

O4 - HKLM\..\Run: [*KEYMAIN] C:\WINDOWS\WEB\KEYMAIN.EXE

O4 - HKLM\..\Run: [*DOCVSS] C:\WINDOWS\INF\DOCVSS.EXE

O4 - HKLM\..\Run: [*TCPVGA] C:\WINDOWS\SYSTEM32\TCPVGA.EXE

O4 - HKLM\..\Run: [*ADWIN] C:\WINDOWS\SYSTEM\MACROMED\FLASH\ADWIN.EXE

O4 - HKLM\..\Run: [*ACRAS] C:\WINDOWS\TASKS\ACRAS.EXE

O4 - HKLM\..\Run: [IPODBC] C:\WINDOWS\WEB\IPODBC.EXE

O4 - HKLM\..\Run: [*RASANTI] C:\WINDOWS\INF\CATALOG\RASANTI.EXE

O4 - HKLM\..\Run: [PCXML] C:\WINDOWS\WEB\PCXML.EXE

O4 - HKLM\..\Run: [*MCREG] C:\WINDOWS\APPPATCH\MCREG.EXE

O4 - HKLM\..\Run: [*CDVD] C:\WINDOWS\WINDOWS UPDATE SETUP FILES\CDVD.EXE

O4 - HKLM\..\Run: [CRLIB] C:\WINDOWS\WINDOWS UPDATE SETUP FILES\CRLIB.EXE

O4 - HKLM\..\Run: [*PCMC] C:\WINDOWS\WEB\PCMC.EXE

O4 - HKLM\..\Run: [*JAVAPC] C:\WINDOWS\WINDOWS UPDATE SETUP FILES\JAVAPC.EXE

O4 - HKLM\..\Run: [WINC] C:\WINDOWS\WINDOWS UPDATE SETUP FILES\WINC.EXE

O4 - HKLM\..\Run: [*FONTPLAY] C:\WINDOWS\FONTPLAY.EXE

O4 - HKLM\..\Run: [*DVDCAB] C:\WINDOWS\SYSTEM32\DVDCAB.EXE

O4 - HKLM\..\Run: [*BAK] C:\WINDOWS\TASKS\BAK.EXE

O4 - HKLM\..\Run: [*EXPBIN] C:\WINDOWS\JAVA\CLASSES\EXPBIN.EXE

O4 - HKLM\..\Run: [*VGAINET] C:\WINDOWS\FONTS\VGAINET.EXE

O4 - HKLM\..\Run: [*REGBIN] C:\WINDOWS\JAVA\REGBIN.EXE

O4 - HKLM\..\Run: [*BAKDISK] C:\WINDOWS\HELP\MIT\BAKDISK.EXE

O4 - HKLM\..\Run: [*FTPUTIL] C:\WINDOWS\FTPUTIL.EXE

O4 - HKLM\..\Run: [*EULABAK] C:\WINDOWS\HELP\KB\EULABAK.EXE

O4 - HKLM\..\Run: [*ASMSVC] C:\WINDOWS\CURSORS\ASMSVC.EXE

O4 - HKLM\..\Run: [*EXPLIB] C:\WINDOWS\CONFIG\EXPLIB.EXE

O4 - HKLM\..\Run: [*WAVECR] C:\WINDOWS\CONFIG\WAVECR.EXE

O4 - HKLM\..\Run: [*JAVAUTIL] C:\WINDOWS\HELP\KB\JAVAUTIL.EXE

O4 - HKLM\..\Run: [*CATTAPI] C:\WINDOWS\CURSORS\CATTAPI.EXE

O4 - HKLM\..\Run: [*WAVEBIN] C:\WINDOWS\WINDOWS UPDATE SETUP FILES\WAVEBIN.EXE

O4 - HKLM\..\Run: [*MCRAS] C:\WINDOWS\WEB\MCRAS.EXE

O4 - HKLM\..\Run: [*BASFTP] C:\WINDOWS\HELP\MIT\BASFTP.EXE

O4 - HKLM\..\Run: [*TCPHARD] C:\WINDOWS\CONFIG\TCPHARD.EXE

O4 - HKLM\..\Run: [*REGHARD] C:\WINDOWS\WEB\REGHARD.EXE

O4 - HKLM\..\Run: [*APCR] C:\WINDOWS\TASKS\APCR.EXE

O4 - HKLM\..\Run: [*ODBCCR] C:\WINDOWS\SYSTEM\ODBCCR.EXE

O4 - HKLM\..\Run: [*ASWAVE] C:\WINDOWS\CONFIG\ASWAVE.EXE

O4 - HKLM\..\Run: [*UTILVB] C:\WINDOWS\APPPATCH\UTILVB.EXE

O4 - HKLM\..\Run: [*ACCAS] C:\WINDOWS\INF\ACCAS.EXE

O4 - HKLM\..\Run: [*SMAIN] C:\WINDOWS\JAVA\TRUSTLIB\SMAIN.EXE

O4 - HKLM\..\Run: [*FONTIMG] C:\WINDOWS\FONTIMG.EXE

O4 - HKLM\..\Run: [*INFOURL] C:\WINDOWS\HELP\MIT\INFOURL.EXE

O4 - HKLM\..\Run: [*PSAP] C:\WINDOWS\CURSORS\PSAP.EXE

O4 - HKLM\..\Run: [*ABRPLAY] C:\WINDOWS\TASKS\ABRPLAY.EXE

O4 - HKLM\..\Run: [*VBWAVE] C:\WINDOWS\HELP\VBWAVE.EXE

O4 - HKLM\..\Run: [*FONTWEB] C:\WINDOWS\HELP\MIT\FONTWEB.EXE

O4 - HKLM\..\Run: [*ADFONT] C:\WINDOWS\JAVA\CLASSES\ADFONT.EXE

O4 - HKLM\..\Run: [*FAXTAPI] C:\WINDOWS\CONFIG\FAXTAPI.EXE

O4 - HKLM\..\Run: [*INFOCMD] C:\WINDOWS\CONFIG\INFOCMD.EXE

O4 - HKLM\..\Run: [*FONTDOC] C:\WINDOWS\CONFIG\FONTDOC.EXE

O4 - HKLM\..\Run: [*FAXDB] C:\WINDOWS\WINDOWS UPDATE SETUP FILES\FAXDB.EXE

O4 - HKLM\..\Run: [*PLAYAD] C:\WINDOWS\SYSTEM\SFP\TEMPCATS\PLAYAD.EXE

O4 - HKLM\..\Run: [*IMGKB] C:\WINDOWS\SYSTEM\CATROOT\IMGKB.EXE

O4 - HKLM\..\Run: [*UNS] C:\WINDOWS\APPPATCH\UNS.EXE

O4 - HKLM\..\Run: [*AVAD] C:\WINDOWS\APPPATCH\AVAD.EXE

O4 - HKLM\..\Run: [*CLOG] C:\WINDOWS\CLOG.EXE

O4 - HKLM\..\Run: [*HARDTCP] C:\WINDOWS\HARDTCP.EXE

O4 - HKLM\..\Run: [*KEYMSVC] C:\WINDOWS\APPPATCH\KEYMSVC.EXE

O4 - HKLM\..\Run: [*LIBC] C:\WINDOWS\TASKS\LIBC.EXE

O4 - HKLM\..\Run: [*KBLOG] C:\WINDOWS\CONFIG\KBLOG.EXE

O4 - HKLM\..\Run: [*LIBOLE] C:\WINDOWS\INF\QFE\LIBOLE.EXE

O4 - HKLM\..\Run: [*ADRAS] C:\WINDOWS\SYSTEM\SHELLNEW\ADRAS.EXE

O4 - HKLM\..\Run: [*ABRMSVC] C:\WINDOWS\INF\ABRMSVC.EXE

O4 - HKLM\..\Run: [*CVGA] C:\WINDOWS\MSAGENT\CHARS\CVGA.EXE

O4 - HKLM\..\Run: [*dosac] C:\WINDOWS\MSAGENT\CHARS\DOSAC.EXE

O4 - HKLM\..\Run: [*maintask] C:\WINDOWS\MAINTASK.EXE

O4 - HKLM\..\Run: [*antic] C:\WINDOWS\APPPATCH\ANTIC.EXE

O4 - HKLM\..\Run: [*olejava] C:\WINDOWS\MSAGENT\OLEJAVA.EXE

O4 - HKLM\..\Run: [*infotapi] C:\WINDOWS\CONFIG\INFOTAPI.EXE

O4 - HKLM\..\Run: [*ipdrv] C:\WINDOWS\SYSTEM\COLOR\IPDRV.EXE

O4 - HKLM\..\Run: [*wmstapi] C:\WINDOWS\JAVA\TRUSTLIB\WMSTAPI.EXE

O4 - HKLM\..\RunOnce: [*KEYMSVC] C:\WINDOWS\APPPATCH\KEYMSVC.EXE rerun

O16 - DPF: {9DBAFCCF-592F-FFFF-FFFF-00608CEC297C} - http://download.weatherbug.com/minibug/tri…uginstaller.cab

O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IMDownloader Class) - http://www2.incredimail.com/contents/setup…er/imloader.cab

O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://imgfarm.com/images/nocache/funwebpr…etup1.0.0.8.cab

O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} (MetaStreamCtl Class) - https://components.viewpoint.com/MTSInstall…215C4ECF918}096

Then click "Fix checked".

Reboot in "safe" mode.

Delete all files in this folder:

C:\WINDOWS\temp <— FOLDER

Reboot in normal mode and "copy/paste" a new log file into this thread. :)

P.S. This is the WORST "Stopguard" infection I've ever seen!!!!! :(
Post #3
I completed all of the above (phew!). The new log is below. Looks much much better.
Thanks so much for your help.



Logfile of HijackThis v1.98.2
Scan saved at 8:34:09 PM, on 12/2/2004
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\SSDPSRV.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\NETROPA\ONE-TOUCH MULTIMEDIA KEYBOARD\MMKEYBD.EXE
C:\WINDOWS\SYSTEM\HPSYSDRV.EXE
C:\WINDOWS\DELAYRUN.EXE
C:\PROGRAM FILES\MOVIE MAKER\HP SHARE-TO-WEB\HPGS2WND.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\PROGRAM FILES\MSN APPS\UPDATER\01.02.3000.1001\EN-US\MSNAPPAU.EXE
C:\PROGRAM FILES\MOVIE MAKER\HP SHARE-TO-WEB\HPGS2WNF.EXE
C:\WINDOWS\RunDLL.exe
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\NETROPA\ONE-TOUCH MULTIMEDIA KEYBOARD\KEYBDMGR.EXE
C:\PROGRAM FILES\NETROPA\ONSCREEN DISPLAY\OSD.EXE
C:\PROGRAM FILES\NETROPA\ONE-TOUCH MULTIMEDIA KEYBOARD\MMUSBKB2.EXE
C:\MY DOCUMENTS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.com/0SEENUS/SAOS01
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.yahoo.com/search/ie.html
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\PROGRAM FILES\MSN APPS\MSN TOOLBAR\01.02.3000.1001\EN-US\MSNTB.DLL
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\PROGRAM FILES\MSN APPS\ST\01.02.3000.1002\EN-XU\STMAIN.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\PROGRAM FILES\MSN APPS\MSN TOOLBAR\01.02.3000.1001\EN-US\MSNTB.DLL
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [Keyboard Manager] C:\Program Files\Netropa\One-touch Multimedia Keyboard\MMKeybd.exe
O4 - HKLM\..\Run: [HPScanPatch] C:\WINDOWS\SYSTEM\HPScanFix.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [Delay] C:\WINDOWS\delayrun.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Movie Maker\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe -osboot
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-us\msnappau.exe"
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [SSDPSRV] C:\WINDOWS\SYSTEM\ssdpsrv.exe
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe"
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: MSN Messenger Service - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
Post #4
Log looks good. :thumbup:

GOD bless!!!

M68 :)

Items you may wish to consider to harden your defenses against future infections:

Read "How did I get infected in the first place?" here:

http://boards.cexx.org/viewtopic.php?t=957

Download IE-Spyad here:

https://netfiles.uiuc.edu/ehowes/www/resource.htm

IE-Spyad puts over 4000 known malicious web sites into IE's "restricted zone" to help prevent you from getting infected.

Check your browser settings here:

http://browsercheck.qualys.com/index.php

A series of "tests" (and suggested fixes) to help tweak IE's settings to help prevent infections when surfing the web.

Follow safe Internet practices:

1. Keep your virus definitions up to date, and scan your system regularly.

2. Don't open email, or download attachments from unrecognized email addresses.

3. Be careful when downloading email attachments, EVEN FROM PEOPLE YOU KNOW! Many virii, worms, and trojans infect a persons system then immeadiately spread themselves to the people in the infected persons addressbook via email attachments.

4. Be careful downloading files from the Internet. Scan all downloaded files with a reliable UP-TO-DATE antivirus program. Scan "zip" files BEFORE unzipping, and scan all unzipped files BEFORE USING THEM.

5. Keep your Windows and IE current with all the latest patches and updates.

Post #5
This topic is now closed.

If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.

If this is not your thread please start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI