What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Help Needed Please

21 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Hi webmax, I'm not at all surprised that something in that log didn't refuse to go. We are fortunate that more didn't. Lets see if this gets it. Please REBOOT into safe mode by tapping on F8 frequently, during Bootup. Make sure your settings allow you to view "Hidden files". Open up any explorer windows and click on "Tools" => "Folder Options" => "View" and be sure to check off "Show Hidden Files and Folders". Close all programs and windows, run Hijack This. Place a check against the following item: O2 - BHO: (no name) - {06FEF3EF-AEBF-AF93-BDBF-79750984DFC9} - (no file) Click on Fix Checked and exit HijackThis. Reboot into normal mode, enable hidden files and post a fresh Hijack This log in this thread, Using the Add/Reply feature, so I will be notified.
Post #17
Piatan,

Still doesn't want to go. Heres the latest log file…..

webmax

————-

Logfile of HijackThis v1.99.0
Scan saved at 23:09:30, on 06/02/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Symantec\Norton Ghost 2003\GhostStartService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ASUS\Probe\AsusProb.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
C:\WINDOWS\System32\hphmon04.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Symantec\Norton Ghost 2003\GhostStartTrayApp.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe
C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe
C:\Program Files\VoyagerTest\fts.exe
C:\WINDOWS\System32\LVComS.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\AOL 9.0\aoltray.exe
C:\Program Files\AOL Companion\companion.exe
C:\Program Files\FinePixViewer\QuickDCF.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
O2 - BHO: (no name) - {06FEF3EF-AEBF-AF93-BDBF-79750984DFC9} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_19_0.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Probe\AsusProb.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [HPHmon04] C:\WINDOWS\System32\hphmon04.exe
O4 - HKLM\..\Run: [HPHUPD04] "C:\Program Files\HP Photosmart 11\hphinstall\UniPatch\hphupd04.exe"
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [GhostStartTrayApp] C:\Program Files\Symantec\Norton Ghost 2003\GhostStartTrayApp.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [DSLSTATEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe icon
O4 - HKLM\..\Run: [DSLAGENTEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe
O4 - HKLM\..\Run: [%FP%Friendly fts.exe] "C:\Program Files\VoyagerTest\fts.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: AOL 9.0 Tray Icon.lnk = C:\Program Files\AOL 9.0\aoltray.exe
O4 - Global Startup: AOL Companion.lnk = C:\Program Files\AOL Companion\companion.exe
O4 - Global Startup: Exif Launcher.lnk = ?
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O4 - Global Startup: ZoneAlarm.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{9EDE13E9-DBF0-4296-B407-816A84537376}: NameServer = 192.168.1.1
O23 - Service: AOL Connectivity Service - America Online, Inc. - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AVG7 Alert Manager Server - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: GhostStartService - Symantec Corporation - C:\Program Files\Symantec\Norton Ghost 2003\GhostStartService.exe
O23 - Service: Pml Driver HPH11 - HP - C:\WINDOWS\System32\HPHipm11.exe
O23 - Service: Sony SPTI Service - Sony Corporation - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\Sptisrv.exe
O23 - Service: TrueVector Internet Monitor - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
Post #19
Piatan, Doesn't look too promising :( Heres the log….. webmax ————– C:\Documents and Settings\Dave\Desktop\qoologic PLEASE NOTE THAT ALL FILES FOUND BY THIS METHOD ARE NOT BAD FILES, THERE MIGHT BE LEGIT FILES LISTED AND PLEASE BE CAREFUL WHILE FIXING. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE. Files Found in system Folder………… ———————— Files Found in all users startup Folder………… ———————— Files Found in all users windows Folder………… ———————— Finished
Post #20
Hi webmax.
It occurred to me that we have not ran any online scans and that you possibly do not have the latest versions of Ad-Aware SE and Spybot S&D.
Often these will find and fix things that are not visable in the Hijack This logs.

Go here and run ALL of the online scans, allow them to delete whatever they find:

Be sure and put a check in the box by "Auto Clean" before you do the scan. If it finds anything that it cannot clean have it delete it or make a note of the file location, so you can delete it yourself.

TrendMicro HouseCall
eTrust AntiVirus Web Scanner
Panda ActiveScan
Note any thing that can't be fixed
Reboot when done.

And here are links to two online Trojan Scanners. Lets run both of these too.

http://scan.sygatetech.com/pretrojanscan.html

And here:
http://www.windowsecurity.com/trojanscan/


Then,
Install and how to use Ad-aware SE
http://www.bleepingcomputer.com/forums/ind…showtutorial=48

Reboot after using Ad-Aware SE.
Download the VX cleaner plug in for Adaware. Install it, then open Adaware & go to *add-ons* & run the plug-in. If anything is found, select *clean system* & when done, reboot & run Adaware & let it finish the clean-up. Reboot again.


Would you please download the Spybot S&D program from here Spybot S&D 1.3 and install it.
  • Select Search for updates.
  • Then select all available updates that are displayed in the white box.
  • Select a download mirror nearest your location.
  • Then select Download updates .
  • Shut down and restart Spybot.
  • Select the Search and destroy icon and click on Check for Problems.
  • Delete/fix anything that spybot lists In RED.
.

Then, please REBOOT, to allow Spybot to finish working

Then please run Hijack This, copy the log and post it here, in this string, using the Add Reply feature, so I will be notified.
Post #21
Piatan,

Starting to get a bit peeved with this, I think I'll re-install the machine if we don't get a solution soon. Its not you, its me, I can't spend much more time on this, and we don't seem to be getting to the root of the problem.

Cheers anyway,


webmax

—————

Logfile of HijackThis v1.99.0
Scan saved at 22:21:42, on 08/02/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Symantec\Norton Ghost 2003\GhostStartService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ASUS\Probe\AsusProb.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
C:\WINDOWS\System32\hphmon04.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Symantec\Norton Ghost 2003\GhostStartTrayApp.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe
C:\WINDOWS\System32\LVComS.exe
C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe
C:\Program Files\VoyagerTest\fts.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\AOL 9.0\aoltray.exe
C:\Program Files\AOL Companion\companion.exe
C:\Program Files\FinePixViewer\QuickDCF.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\WinZip\WZQKPICK.EXE
c:\progra~1\intern~1\iexplore.exe
C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
O2 - BHO: (no name) - {06FEF3EF-AEBF-AF93-BDBF-79750984DFC9} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_19_0.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Probe\AsusProb.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [HPHmon04] C:\WINDOWS\System32\hphmon04.exe
O4 - HKLM\..\Run: [HPHUPD04] "C:\Program Files\HP Photosmart 11\hphinstall\UniPatch\hphupd04.exe"
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [GhostStartTrayApp] C:\Program Files\Symantec\Norton Ghost 2003\GhostStartTrayApp.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [DSLSTATEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe icon
O4 - HKLM\..\Run: [DSLAGENTEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe
O4 - HKLM\..\Run: [%FP%Friendly fts.exe] "C:\Program Files\VoyagerTest\fts.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [Proc Mags Info Bat] C:\Documents and Settings\All Users\Application Data\bibsectprocmags\Build Poll.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [helpmode] C:\DOCUME~1\Dave\APPLIC~1\DVDSET~1\Sectfree.exe
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: AOL 9.0 Tray Icon.lnk = C:\Program Files\AOL 9.0\aoltray.exe
O4 - Global Startup: AOL Companion.lnk = C:\Program Files\AOL Companion\companion.exe
O4 - Global Startup: Exif Launcher.lnk = ?
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O4 - Global Startup: ZoneAlarm.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{9EDE13E9-DBF0-4296-B407-816A84537376}: NameServer = 192.168.1.1
O23 - Service: AOL Connectivity Service - America Online, Inc. - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AVG7 Alert Manager Server - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: GhostStartService - Symantec Corporation - C:\Program Files\Symantec\Norton Ghost 2003\GhostStartService.exe
O23 - Service: Pml Driver HPH11 - HP - C:\WINDOWS\System32\HPHipm11.exe
O23 - Service: Sony SPTI Service - Sony Corporation - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\Sptisrv.exe
O23 - Service: TrueVector Internet Monitor - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
Post #22 last edited
Hi webmax.
Yes, it does sometimes get tedious.
You might want to give this a try.

Download: supershell.zip
http://p-nand-q.com/download/tools/supershell.zip

Unzip supershell.zip

Make sure you are logged in under an Administrator account.
(or are a user with Administrator privledges)
Open the unzipped SuperShell folder.
Double-click (launch) SuperShell.exe.

This will launch a Command Prompt window.
at the prompt type regedit and press enter.

Regedit will open. At the top of the window click edit then copy and paste

the following into the window.

{06FEF3EF-AEBF-AF93-BDBF-79750984DFC9}

Then click find now.
When you find the entry right click on it and select delete, anwer ok at

the prompt.
Next, press "F3" to continue searching, if another instance is found,

repeat the above steps, until you see the "completed searching" message.

If you get a (Permissions) error?
Right-click the key (left pane)

Click Advanced [button]
If the "Inherit Permissions" box is checked = Uncheck it.
Then select "COPY" on the prompt.

Select "Everyone Group" (if listed) and remove. (only the group)
You can individually view/edit each group settings.
Be sure "Administrators" and "System" have full control on all.
Note: Creator owner full control on Sub keys only.
"Power users" and "users" = "read control".

Then, please post a fresh Hijack This log.
Post #23
Piatan, The pc is going out the window…. It won't let me delete the registry entry, I've tried following your instructions on how to change permissions, but after clicking the Advanced button, I can't see the inherit permissions box, and don't undersand enough about users and permissions in windows to change them. If you could give me slightly more detailed instructions, I'll try again. Cheers Webmax. PS I don't seem to be getting emails when you post new instructions anymore.
Post #25
Siggyx, The pc runs very slow, takes 2-3 mins to finish booting up, this has improved since things have been cleaned off, but not by much. I keep getting warnings from one of the protection programs saying that ie's home page has been changed for
Post #26
Ok just wondering. I see LOP infection in the log. Please go to add/remove programs and see if MessengerPlus is present. If so remove it. Then scan and post a new hijackthis log please.
Post #27
Hi webmax.

Siggyx also requests that you do the following.

Please download the Micro World scanner from the link below. Make sure before you scan that you choose all directories. This scan will take a long time and in fact fixes nothing. However, in the scanner you will see 2 boxes. The lower box will list all the bad files, if any, on your system. Please copy and paste the information from the lower box in your response please. Also include a fresh Hijack This log.

http://www.mwti.net/antivirus/free_utilities.asp
Post #28
Piatan, Siggyx,

MessengerPlus did not exist, so here are the logs after running the Micro World scanner…..

webmax

——————–

File c:\docume~1\dave\locals~1\temp\mpkvcxic.exe infected by "not-a-virus:AdWare.Lop.k" Virus. Action Taken: No Action Taken.
File C:\DOCUME~1\ALLUSE~1\APPLIC~1\BIBSEC~1\BUILDP~1.EXE infected by "not-a-virus:AdWare.Lop.j" Virus. Action Taken: No Action Taken.
File C:\DOCUME~1\Dave\APPLIC~1\DVDSET~1\Sectfree.exe infected by "not-a-virus:AdWare.Lop.k" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\CP14.exe infected by "Trojan-Downloader.Win32.Small.ahx" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\d8.exe infected by "Trojan-Downloader.Win32.Small.ahx" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\woinstall.exe infected by "not-a-virus:AdWare.EZula.ak" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\akcore.dll infected by "not-a-virus:AdWare.Coreak" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\vwqxg.dll infected by "not-a-virus:AdWare.Adstart.c" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\vwqxgd.exe infected by "not-a-virus:AdWare.Adstart.b" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\vwqxgf.exe infected by "not-a-virus:AdWare.Adstart.d" Virus. Action Taken: No Action Taken.
File C:\DOCUME~1\Dave\LOCALS~1\Temp\252836.exe infected by "Trojan-Downloader.Win32.Swizzor.ca" Virus. Action Taken: No Action Taken.
File C:\DOCUME~1\Dave\LOCALS~1\Temp\epyhrzcs.exe infected by "not-a-virus:AdWare.Lop.k" Virus. Action Taken: No Action Taken.
File C:\DOCUME~1\Dave\LOCALS~1\Temp\mpkvcxic.exe infected by "not-a-virus:AdWare.Lop.k" Virus. Action Taken: No Action Taken.
File C:\DOCUME~1\Dave\LOCALS~1\TEMPOR~1\Content.IE5\YBR4T37H\upAYB_unk[1].int infected by "Trojan-Downloader.Win32.Swizzor.ca" Virus. Action Taken: No Action Taken.
File C:\Documents and Settings\All Users\Application Data\bibsectprocmags\Boob 64.exe infected by "Trojan-Downloader.Win32.Swizzor.bz" Virus. Action Taken: No Action Taken.
File C:\Documents and Settings\All Users\Application Data\bibsectprocmags\heartshow.exe infected by "not-a-virus:AdWare.Lop.j" Virus. Action Taken: No Action Taken.
File C:\Documents and Settings\All Users\Application Data\bibsectprocmags\Lite chin.exe infected by "Trojan-Downloader.Win32.Swizzor.cn" Virus. Action Taken: No Action Taken.
File C:\Documents and Settings\All Users\Application Data\bibsectprocmags\Long pure.exe infected by "Trojan-Downloader.Win32.Swizzor.cn" Virus. Action Taken: No Action Taken.
File C:\Documents and Settings\All Users\Application Data\bibsectprocmags\Owns dvd.exe infected by "Trojan-Downloader.Win32.Swizzor.cn" Virus. Action Taken: No Action Taken.
File C:\Documents and Settings\Dave\Application Data\dvd settings\fagbjxsc.exe infected by "not-a-virus:AdWare.Lop.j" Virus. Action Taken: No Action Taken.
File C:\Documents and Settings\Dave\Application Data\dvd settings\hwijldjf.exe infected by "Trojan-Downloader.Win32.Swizzor.cn" Virus. Action Taken: No Action Taken.
File C:\Documents and Settings\Dave\Application Data\dvd settings\jlbuehzh.exe infected by "not-a-virus:AdWare.Lop.j" Virus. Action Taken: No Action Taken.
File C:\Documents and Settings\Dave\Application Data\dvd settings\lies part 1 owns.exe infected by "Trojan-Downloader.Win32.Swizzor.ca" Virus. Action Taken: No Action Taken.
File C:\Documents and Settings\Dave\Application Data\dvd settings\lwcmfhdx.exe infected by "Trojan-Downloader.Win32.Swizzor.cc" Virus. Action Taken: No Action Taken.
File C:\Documents and Settings\Dave\Application Data\dvd settings\mkejzxep.exe infected by "Trojan-Downloader.Win32.Swizzor.cn" Virus. Action Taken: No Action Taken.
File C:\Documents and Settings\Dave\Application Data\dvd settings\rulewayhope.exe infected by "Trojan-Downloader.Win32.Swizzor.cb" Virus. Action Taken: No Action Taken.
File C:\Documents and Settings\Dave\Application Data\dvd settings\towqcwcj.exe infected by "Trojan-Downloader.Win32.Swizzor.cn" Virus. Action Taken: No Action Taken.
File C:\Documents and Settings\Dave\Application Data\dvd settings\uuvaujkt.exe infected by "Trojan-Downloader.Win32.Swizzor.cc" Virus. Action Taken: No Action Taken.
File C:\Documents and Settings\Dave\Application Data\dvd settings\weaseyax.exe infected by "Trojan-Downloader.Win32.Swizzor.cm" Virus. Action Taken: No Action Taken.
File C:\Documents and Settings\Dave\Application Data\dvd settings\xdokcwdb.exe infected by "Trojan-Downloader.Win32.Swizzor.bz" Virus. Action Taken: No Action Taken.
File C:\Documents and Settings\Dave\Application Data\dvd settings\zhkhildz.exe infected by "not-a-virus:AdWare.Lop.j" Virus. Action Taken: No Action Taken.
File C:\Documents and Settings\Dave\Application Data\Gram aim long\Soft Mfcd.exe infected by "Trojan-Downloader.Win32.Swizzor.bo" Virus. Action Taken: No Action Taken.
File C:\Documents and Settings\Dave\Desktop\l2mfix\Process.exe tagged as not-a-virus:RiskWare.Tool.Processor.20. No Action Taken.
File C:\Documents and Settings\Dave\Desktop\l2mfix.exe tagged as not-a-virus:RiskWare.Tool.Processor.20. No Action Taken.
File C:\Documents and Settings\Dave\Local Settings\Application Data\Wildtangent\Cdacache\00\00\0D.dat infected by "not-a-virus:AdWare.WildTangent.b" Virus. Action Taken: No Action Taken.
File C:\Documents and Settings\Dave\Local Settings\Temp\252836.exe infected by "Trojan-Downloader.Win32.Swizzor.ca" Virus. Action Taken: No Action Taken.
File C:\Documents and Settings\Dave\Local Settings\Temp\epyhrzcs.exe infected by "not-a-virus:AdWare.Lop.k" Virus. Action Taken: No Action Taken.
File C:\Documents and Settings\Dave\Local Settings\Temp\mpkvcxic.exe infected by "not-a-virus:AdWare.Lop.k" Virus. Action Taken: No Action Taken.
File C:\Documents and Settings\Dave\Local Settings\Temporary Internet Files\Content.IE5\YBR4T37H\upAYB_unk[1].int infected by "Trojan-Downloader.Win32.Swizzor.ca" Virus. Action Taken: No Action Taken.
File C:\Program Files\AOL 9.0\Jiti\Jiti_mm.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Program Files\Common Files\aolback\comp01.000 tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Program Files\MySearch\bar\1.bin\NPMYSRCH.DLL infected by "not-a-virus:AdWare.ToolBar.MyWay.j" Virus. Action Taken: No Action Taken.
File C:\Program Files\MySearch\bar\1.bin\S42NS.EXE infected by "not-a-virus:AdWare.ToolBar.MyWay.j" Virus. Action Taken: No Action Taken.
File C:\Program Files\TopConverting\pacman\pacman.exe infected by "not-a-virus:AdWare.WinShow.f" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP110\A0059163.ocx infected by "not-a-virus:AdWare.DelphinMediaViewer.c" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP110\A0059164.dll infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP110\A0059170.exe infected by "not-a-virus:AdWare.WebSearch.i" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP110\A0059172.exe infected by "not-a-virus:AdWare.Wintol.p" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP110\A0059182.dll infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP110\A0059188.exe infected by "not-a-virus:AdWare.WebSearch.i" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP110\A0059189.exe infected by "not-a-virus:AdWare.Wintol.p" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP110\A0059195.dll infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP110\A0059197.exe infected by "not-a-virus:AdWare.Wintol.p" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP110\A0059198.dll infected by "not-a-virus:AdWare.Wintol.p" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP110\A0059208.dll infected by "not-a-virus:AdWare.WebSearch.l" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP110\A0059209.exe infected by "not-a-virus:AdWare.WebSearch.i" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP110\A0059210.dll infected by "not-a-virus:AdWare.WebSearch.l" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP110\A0059212.exe infected by "not-a-virus:AdWare.Wintol.p" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP110\A0059213.exe infected by "not-a-virus:AdWare.WebSearch.i" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP110\A0059214.dll infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP110\A0059218.dll infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP110\A0059226.dll infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP110\A0059233.DLL infected by "not-a-virus:AdWare.ToolBar.MyWebSearch" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP110\A0059235.DLL infected by "not-a-virus:AdWare.ToolBar.MyWebSearch" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP110\A0059236.DLL infected by "not-a-virus:AdWare.ToolBar.MyWebSearch" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP110\A0059237.DLL infected by "not-a-virus:AdWare.ToolBar.MyWebSearch" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP110\A0059238.DLL infected by "not-a-virus:AdWare.ToolBar.MyWebSearch" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP110\A0059239.EXE infected by "not-a-virus:AdWare.ToolBar.MyWebSearch" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP110\A0059240.DLL infected by "not-a-virus:AdWare.ToolBar.MyWebSearch" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP110\A0059241.DLL infected by "not-a-virus:AdWare.ToolBar.MyWebSearch" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP110\A0059242.DLL infected by "not-a-virus:AdWare.ToolBar.MyWebSearch" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP110\A0059243.DLL infected by "not-a-virus:AdWare.ToolBar.MyWebSearch" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP110\A0059244.DLL infected by "not-a-virus:AdWare.ToolBar.MyWebSearch" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP110\A0059245.DLL infected by "not-a-virus:AdWare.ToolBar.MyWebSearch" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP110\A0059246.DLL infected by "not-a-virus:AdWare.ToolBar.MyWebSearch" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP110\A0059247.DLL infected by "not-a-virus:AdWare.ToolBar.MyWebSearch" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP110\A0059275.exe infected by "not-a-virus:AdWare.Adstart.b" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP110\A0059276.dll infected by "not-a-virus:AdWare.DelphinMediaViewer.c" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP110\A0059277.exe infected by "not-a-virus:AdWare.DelphinMediaViewer.c" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP110\A0059278.exe infected by "not-a-virus:AdWare.DelphinMediaViewer.c" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP110\A0059279.exe infected by "not-a-virus:AdWare.Lop.k" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP110\A0059280.exe infected by "Trojan-Downloader.Win32.Swizzor.bo" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP110\A0059282.dll infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP111\A0059294.exe infected by "Trojan-Downloader.Win32.Swizzor.bz" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP111\A0059295.exe infected by "not-a-virus:AdWare.Lop.j" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP111\A0059296.exe infected by "Trojan-Downloader.Win32.Swizzor.cn" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP111\A0059297.exe infected by "Trojan-Downloader.Win32.Swizzor.cn" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP111\A0059298.exe infected by "Trojan-Downloader.Win32.Swizzor.cn" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP111\A0059299.exe infected by "Trojan-Downloader.Win32.Swizzor.ca" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP111\A0059300.exe infected by "Trojan-Downloader.Win32.Swizzor.cb" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP112\A0059309.exe infected by "not-a-virus:AdWare.Zestyfind" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP115\A0059317.dll infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP115\A0059334.dll infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP117\A0059353.dll infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP117\A0059368.dll infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP118\A0059384.dll infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP118\A0059393.dll infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP118\A0059394.dll infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP118\A0059395.dll infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP118\A0059396.dll infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP118\A0059397.dll infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP118\A0059398.dll infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP118\A0059399.dll infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP118\A0059400.dll infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP118\A0059401.dll infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP118\A0059402.dll infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP118\A0059403.dll infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP118\A0059404.dll infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP118\A0059405.dll infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP118\A0059406.dll infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP118\A0059407.dll infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP118\A0059408.dll infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP118\A0059410.dll infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP118\A0059411.dll infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP118\A0059412.dll infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP118\A0059413.dll infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP118\A0059415.dll infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP118\A0059417.dll infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP118\A0059418.dll infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP118\A0059419.dll infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP118\A0059420.dll infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP118\A0059421.dll infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP118\A0059422.dll infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP118\A0059423.dll infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP118\A0059424.dll infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP118\A0059425.dll infected by "not-a-virus:AdWare.Look2Me.u" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP118\A0059430.exe tagged as not-a-virus:RiskWare.Tool.Processor.20. No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP118\A0059461.exe infected by "not-a-virus:AdWare.Lop.j" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP118\A0059462.exe infected by "Trojan-Downloader.Win32.Swizzor.ca" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP118\A0059463.exe infected by "not-a-virus:AdWare.Lop.k" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP118\A0059464.exe infected by "not-a-virus:AdWare.Lop.k" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP118\A0059465.exe infected by "not-a-virus:AdWare.Lop.k" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP118\A0059467.dll infected by "Trojan.Win32.StartPage.uo" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP119\A0059551.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP119\A0059552.exe infected by "not-a-virus:AdWare.Look2Me.r" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP119\A0059553.exe infected by "Trojan-Downloader.Win32.Swizzor.bz" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP119\A0059554.exe infected by "not-a-virus:AdWare.Lop.j" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP119\A0059555.exe infected by "Trojan-Downloader.Win32.Swizzor.cn" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP119\A0059556.exe infected by "Trojan-Downloader.Win32.Swizzor.cn" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP119\A0059557.exe infected by "Trojan-Downloader.Win32.Swizzor.cn" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP119\A0059558.exe infected by "Trojan-Downloader.Win32.Swizzor.bo" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP119\A0059559.exe infected by "Trojan-Downloader.Win32.Swizzor.ca" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{BA028178-39D8-4D38-BBFB-339F444F7CB6}\RP119\A0059560.exe infected by "Trojan-Downloader.Win32.Swizzor.cb" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\bundles\adl_mteststub.exe infected by "not-a-virus:AdWare.EZula.ah" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\bundles\CSv10P070.exe infected by "not-a-virus:AdWare.ClearSearch.q" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\bundles\ezStubseedcorn.exe infected by "not-a-virus:AdWare.EZula.u" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\bundles\SSK_I.exe infected by "Trojan-Dropper.Win32.Small.qn" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\bundles\WebRebates_Auto_InstallSilent.exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\bundles\wrapperouter.exe infected by "not-a-virus:AdWare.VirtualBouncer.c" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\CP14.exe infected by "Trojan-Downloader.Win32.Small.ahx" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\d8.exe infected by "Trojan-Downloader.Win32.Small.ahx" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\Downloaded Program Files\242515__.exe007 infected by "Trojan.Win32.Dialer.eh" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\Downloaded Program Files\242515__.exe130 infected by "Trojan.Win32.Dialer.eh" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\Downloaded Program Files\ukgolwla2x.exe infected by "Trojan.Win32.Dialer.cj" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\system32\akcore.dll infected by "not-a-virus:AdWare.Coreak" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\system32\Cache\cxtpls_loader.exe infected by "not-a-virus:AdWare.Apropos.b" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\system32\vwqxg.dll infected by "not-a-virus:AdWare.Adstart.c" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\system32\vwqxgd.exe infected by "not-a-virus:AdWare.Adstart.b" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\system32\vwqxgf.exe infected by "not-a-virus:AdWare.Adstart.d" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\woinstall.exe infected by "not-a-virus:AdWare.EZula.ak" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\wt\wtvh.dll infected by "not-a-virus:AdWare.WildTangent.b" Virus. Action Taken: No Action Taken.

and the hijack log……

———————————–

Logfile of HijackThis v1.99.0
Scan saved at 20:51:58, on 13/02/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Symantec\Norton Ghost 2003\GhostStartService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ASUS\Probe\AsusProb.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
C:\WINDOWS\System32\hphmon04.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Symantec\Norton Ghost 2003\GhostStartTrayApp.exe
C:\WINDOWS\System32\LVComS.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe
C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe
C:\Program Files\VoyagerTest\fts.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\AOL 9.0\aoltray.exe
C:\Program Files\FinePixViewer\QuickDCF.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe
C:\Program Files\SpywareGuard\sgmain.exe
c:\progra~1\intern~1\iexplore.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\AOL Companion\companion.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
O2 - BHO: (no name) - {06FEF3EF-AEBF-AF93-BDBF-79750984DFC9} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_19_0.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Probe\AsusProb.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [HPHmon04] C:\WINDOWS\System32\hphmon04.exe
O4 - HKLM\..\Run: [HPHUPD04] "C:\Program Files\HP Photosmart 11\hphinstall\UniPatch\hphupd04.exe"
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [GhostStartTrayApp] C:\Program Files\Symantec\Norton Ghost 2003\GhostStartTrayApp.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [DSLSTATEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe icon
O4 - HKLM\..\Run: [DSLAGENTEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe
O4 - HKLM\..\Run: [%FP%Friendly fts.exe] "C:\Program Files\VoyagerTest\fts.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [Proc Mags Info Bat] C:\Documents and Settings\All Users\Application Data\bibsectprocmags\Build Poll.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [helpmode] C:\DOCUME~1\Dave\APPLIC~1\DVDSET~1\Sectfree.exe
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: AOL 9.0 Tray Icon.lnk = C:\Program Files\AOL 9.0\aoltray.exe
O4 - Global Startup: AOL Companion.lnk = C:\Program Files\AOL Companion\companion.exe
O4 - Global Startup: Exif Launcher.lnk = ?
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O4 - Global Startup: ZoneAlarm.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{9EDE13E9-DBF0-4296-B407-816A84537376}: NameServer = 192.168.1.1
O23 - Service: AOL Connectivity Service - America Online, Inc. - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AVG7 Alert Manager Server - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: GhostStartService - Symantec Corporation - C:\Program Files\Symantec\Norton Ghost 2003\GhostStartService.exe
O23 - Service: Pml Driver HPH11 - HP - C:\WINDOWS\System32\HPHipm11.exe
O23 - Service: Sony SPTI Service - Sony Corporation - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\Sptisrv.exe
O23 - Service: TrueVector Internet Monitor - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
Post #29
Hi webmax

Please REBOOT into safe mode by tapping on F8 frequently, during Bootup.

Make sure your settings allow you to view "Hidden files". Open up any explorer windows and click on "Tools" => "Folder Options" => "View" and be sure to check off "Show Hidden Files and Folders".


Open Windows Explorer locate and delete the following Folder(s)/File(s) in Bold while still in SAFE MODE, if found.


c:\docume~1\dave\locals~1\temp\mpkvcxic.exe
C:\DOCUME~1\ALLUSE~1\APPLIC~1\BIBSEC~1
C:\DOCUME~1\Dave\APPLIC~1\DVDSET~1\Sectfree.exe
C:\WINDOWS\CP14.exe
C:\WINDOWS\d8.exe
C:\WINDOWS\woinstall.exe
C:\WINDOWS\System32\akcore.dll
C:\WINDOWS\System32\vwqxg.dll
C:\WINDOWS\System32\vwqxgd.exe
C:\WINDOWS\System32\vwqxgf.exe
C:\Documents and Settings\All Users\Application Data\bibsectprocmags
C:\Documents and Settings\Dave\Application Data\dvd
C:\Documents and Settings\Dave\Application Data\Gram aim long

Then, in Internet Explorer, go to Tools>Internet Options and clear History, delete "Cookies",delete Temporary Internet files and Offline content.

Reboot into normal mode, enable hidden files and post a fresh Hijack This log in this thread, Using the Add/Reply: feature, so I will be notified.

Note: Do not attempt to "Fix" anything, as we need to see the entire log.
Post #30
Piatan,

Heres the latest log, everything seemed to delete ok, and I'm not getting the message about ie toolbar being changed at the moment.

webmax

————————–

Logfile of HijackThis v1.99.0
Scan saved at 21:38:32, on 14/02/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Symantec\Norton Ghost 2003\GhostStartService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ASUS\Probe\AsusProb.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
C:\WINDOWS\System32\hphmon04.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Symantec\Norton Ghost 2003\GhostStartTrayApp.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe
C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe
C:\WINDOWS\System32\LVComS.exe
C:\Program Files\VoyagerTest\fts.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\AOL 9.0\aoltray.exe
C:\Program Files\AOL Companion\companion.exe
C:\Program Files\FinePixViewer\QuickDCF.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
O2 - BHO: (no name) - {06FEF3EF-AEBF-AF93-BDBF-79750984DFC9} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_19_0.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Probe\AsusProb.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [HPHmon04] C:\WINDOWS\System32\hphmon04.exe
O4 - HKLM\..\Run: [HPHUPD04] "C:\Program Files\HP Photosmart 11\hphinstall\UniPatch\hphupd04.exe"
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [GhostStartTrayApp] C:\Program Files\Symantec\Norton Ghost 2003\GhostStartTrayApp.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [DSLSTATEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe icon
O4 - HKLM\..\Run: [DSLAGENTEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe
O4 - HKLM\..\Run: [%FP%Friendly fts.exe] "C:\Program Files\VoyagerTest\fts.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [Proc Mags Info Bat] C:\Documents and Settings\All Users\Application Data\bibsectprocmags\Build Poll.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [helpmode] C:\DOCUME~1\Dave\APPLIC~1\DVDSET~1\Sectfree.exe
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: AOL 9.0 Tray Icon.lnk = C:\Program Files\AOL 9.0\aoltray.exe
O4 - Global Startup: AOL Companion.lnk = C:\Program Files\AOL Companion\companion.exe
O4 - Global Startup: Exif Launcher.lnk = ?
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O4 - Global Startup: ZoneAlarm.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{9EDE13E9-DBF0-4296-B407-816A84537376}: NameServer = 192.168.1.1
O23 - Service: AOL Connectivity Service - America Online, Inc. - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AVG7 Alert Manager Server - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: GhostStartService - Symantec Corporation - C:\Program Files\Symantec\Norton Ghost 2003\GhostStartService.exe
O23 - Service: Pml Driver HPH11 - HP - C:\WINDOWS\System32\HPHipm11.exe
O23 - Service: Sony SPTI Service - Sony Corporation - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\Sptisrv.exe
O23 - Service: TrueVector Internet Monitor - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI