About Blank

I ran CW Shreader and Spybot. CW found 1 problem and was fixed. Spybot found 93 problems and were fixed. The log reflects a post-CW and Spybot environment. Below is my log. My homepage has been reset, lost some of my toolbar (including pop-up control, my hard drive has been filled to max one minute, then back to previous capacity the next. Files with .js and .hta have been detected, etc. Please help me in the proper removal selections.

Thanks,

Tim


Logfile of HijackThis v1.99.0
Scan saved at 11:29:01 PM, on 1/4/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\PROGRA~1\NORTON~2\SPEEDD~1\nopdb.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\system32\ntnn32.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\WINDOWS\System32\qttask.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\Creative\ShareDLL\CtNotify.exe
C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE
C:\Program Files\Creative\SBLive\Program\CTAvTray.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\LXSUPMON.EXE
C:\PROGRA~1\TEXTBR~1.0\Bin\INSTAN~1.EXE
C:\WINDOWS\system32\msva32.exe
C:\DOCUME~1\TIMS~1\LOCALS~1\Temp\3.tmp.exe
C:\Program Files\BullsEye Network\bin\bargains.exe
C:\Program Files\DeskAd Service\DeskAdServ.exe
C:\Program Files\Creative\ShareDLL\MediaDet.Exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\DeskAd Service\DeskAdKeep.exe
C:\PROGRA~1\PANICW~1\POP-UP~2\PSFree.exe
C:\PROGRA~1\COMMON~1\tsa\tsm2.exe
C:\PROGRA~1\COMMON~1\tsa\ts2.exe
C:\Program Files\ePlus48U\ScanPanel\ScnPanel.exe
C:\DOCUME~1\TIMS~1\LOCALS~1\Temp\Temporary Directory 2 for hijackthis.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\zcspk.dll/sp.html#28129
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\zcspk.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\zcspk.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\zcspk.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\zcspk.dll/sp.html#28129
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\zcspk.dll/sp.html#28129
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\zcspk.dll/sp.html#28129
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Optimum Online
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {B05BB3F1-E281-9429-9161-2EFA4B24E35B} - C:\WINDOWS\system32\atlwa.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [POINTER] C:\Program Files\Microsoft Hardware\Mouse\point32.exe
O4 - HKLM\..\Run: [QuickTime Task] C:\WINDOWS\System32\qttask.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [Disc Detector] C:\Program Files\Creative\ShareDLL\CtNotify.exe
O4 - HKLM\..\Run: [AHQInit] C:\Program Files\Creative\SBLive\Program\AHQInit.exe
O4 - HKLM\..\Run: [AudioHQ] C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE
O4 - HKLM\..\Run: [CTAvTray] C:\Program Files\Creative\SBLive\Program\CTAvTray.EXE
O4 - HKLM\..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe
O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\system32\LXSUPMON.EXE RUN
O4 - HKLM\..\Run: [RegisterDropHandler] C:\PROGRA~1\TEXTBR~1.0\Bin\REGIST~1.EXE
O4 - HKLM\..\Run: [InstantAccess] C:\PROGRA~1\TEXTBR~1.0\Bin\INSTAN~1.EXE /h
O4 - HKLM\..\Run: [msva32.exe] C:\WINDOWS\system32\msva32.exe
O4 - HKLM\..\Run: [3.tmp] C:\DOCUME~1\TIMS~1\LOCALS~1\Temp\3.tmp.exe 0 28129
O4 - HKLM\..\Run: [5.tmp] C:\DOCUME~1\TIMS~1\LOCALS~1\Temp\5.tmp.exe 0 28129
O4 - HKLM\..\Run: [5.tmp.exe] C:\DOCUME~1\TIMS~1\LOCALS~1\Temp\5.tmp.exe 0 28129
O4 - HKLM\..\Run: [sais] c:\program files\180solutions\sais.exe
O4 - HKLM\..\Run: [BullsEye Network] C:\Program Files\BullsEye Network\bin\bargains.exe
O4 - HKLM\..\Run: [DeskAd Service] C:\Program Files\DeskAd Service\DeskAdServ.exe
O4 - HKLM\..\Run: [3.tmp.exe] C:\DOCUME~1\TIMS~1\LOCALS~1\Temp\3.tmp.exe 0 28129
O4 - HKLM\..\RunServices: [RegisterDropHandler] C:\PROGRA~1\TEXTBR~1.0\Bin\REGIST~1.EXE
O4 - HKLM\..\RunOnce: [DELDIR0.EXE] "C:\DOCUME~1\TIMS~1\LOCALS~1\Temp\DELDIR0.EXE" "C:\Program Files\McAfee\McAfee Shared Components\Central"
O4 - HKLM\..\RunOnce: [CTAVTray] C:\Program Files\Creative\SBLive\Program\CTAvStub.EXE EAX.AVI
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe"
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~2\PSFree.exe"
O4 - HKCU\..\Run: [Tsa2] C:\PROGRA~1\COMMON~1\tsa\tsm2.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: ScanPanel.lnk = C:\Program Files\ePlus48U\ScanPanel\ScnPanel.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.optonline.net
O15 - Trusted Zone: *.05p.com
O15 - Trusted Zone: *.awmdabest.com
O15 - Trusted Zone: *.blazefind.com
O15 - Trusted Zone: *.clickspring.net
O15 - Trusted Zone: *.flingstone.com
O15 - Trusted Zone: *.frame.crazywinnings.com
O15 - Trusted Zone: *.mt-download.com
O15 - Trusted Zone: *.my-internet.info
O15 - Trusted Zone: *.scoobidoo.com
O15 - Trusted Zone: *.searchbarcash.com
O15 - Trusted Zone: *.searchmiracle.com
O15 - Trusted Zone: *.slotch.com
O15 - Trusted Zone: *.static.topconverting.com
O15 - Trusted Zone: *.05p.com (HKLM)
O15 - Trusted Zone: *.awmdabest.com (HKLM)
O15 - Trusted Zone: *.blazefind.com (HKLM)
O15 - Trusted Zone: *.clickspring.net (HKLM)
O15 - Trusted Zone: *.flingstone.com (HKLM)
O15 - Trusted Zone: *.frame.crazywinnings.com (HKLM)
O15 - Trusted Zone: *.mt-download.com (HKLM)
O15 - Trusted Zone: *.my-internet.info (HKLM)
O15 - Trusted Zone: *.scoobidoo.com (HKLM)
O15 - Trusted Zone: *.searchbarcash.com (HKLM)
O15 - Trusted Zone: *.searchmiracle.com (HKLM)
O15 - Trusted Zone: *.slotch.com (HKLM)
O15 - Trusted Zone: *.static.topconverting.com (HKLM)
O15 - Trusted IP range: 206.161.125.149
O15 - Trusted IP range: 206.161.124.130 (HKLM)
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/CDTInc/ie/bridge-c46.cab
O16 - DPF: {386A771C-E96A-421F-8BA7-32F1B706892F} (Installer Class) - http://www.xxxtoolbar.com/ist/softwares/v4.0/0006_adult.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200203…meInstaller.exe
O23 - Service: Symantec Event Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: LexBce Server - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Norton AntiVirus Auto Protect Service - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Unerase Protection - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
O23 - Service: ScriptBlocking Service - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~2\SPEEDD~1\nopdb.exe
O23 - Service: SymWMI Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: ZESOFT - Unknown - C:\WINDOWS\zeta.exe
O23 - Service: Remote Procedure Call (RPC) Helper - Unknown - C:\WINDOWS\system32\ntnn32.exe

Thank You, MrCharlie!

Here we go…




The script did not recognize the services listed below.
This does not mean that they are a problem.

To copy the entire contents of this document for posting:
At the top of this window click "Edit" then "Select All"
Next click "Edit" again then "Copy"
Now right click in the forum post box then click "Paste"

########################################

ServiceFilter 1.1
by rand1038

Microsoft Windows XP Home Edition
Version: 5.1.2600 Service Pack 2
Jan 29, 2005 12:04:00 PM




Logfile of HijackThis v1.99.0
Scan saved at 12:10:19 PM, on 1/29/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\PROGRA~1\NORTON~2\SPEEDD~1\nopdb.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\WINDOWS\System32\qttask.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\Creative\ShareDLL\CtNotify.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\TEXTBR~1.0\Bin\INSTAN~1.EXE
C:\WINDOWS\system32\msva32.exe
C:\Program Files\Creative\ShareDLL\MediaDet.Exe
C:\WINDOWS\system32\devldr32.exe
C:\PROGRA~1\PANICW~1\POP-UP~2\PSFree.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\ePlus48U\ScanPanel\ScnPanel.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\ISTsvc\istsvc.exe
C:\WINDOWS\wolngeoj.exe
c:\program files\180solutions\sais.exe
C:\Program Files\Web_Rebates\WebRebates1.exe
C:\Program Files\Windows AdStatus\WinStat.exe
C:\Program Files\Windows AdStatus\WinStatKeep.exe
C:\temp\NCASEP~1.EXE
C:\temp\NCASEP~1.EXE
C:\temp\NCASEP~1.EXE
C:\Program Files\Web_Rebates\WebRebates0.exe
C:\WINDOWS\system32\ntnn32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\DOCUME~1\TIMS~1\LOCALS~1\Temp\Temporary Directory 5 for hijackthis.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\zpjjb.dll/sp.html#28129
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\zpjjb.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\zpjjb.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\zpjjb.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\zpjjb.dll/sp.html#28129
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\zpjjb.dll/sp.html#28129
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\zpjjb.dll/sp.html#28129
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Optimum Online
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {B4126314-CC73-79E1-D2AC-CA3BC0E2B1EC} - C:\WINDOWS\system32\sdkny.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: ISTbar - {5F1ABCDB-A875-46c1-8345-B72A4567E486} - C:\PROGRA~1\ISTbar\istbar.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [POINTER] C:\Program Files\Microsoft Hardware\Mouse\point32.exe
O4 - HKLM\..\Run: [QuickTime Task] C:\WINDOWS\System32\qttask.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [Disc Detector] C:\Program Files\Creative\ShareDLL\CtNotify.exe
O4 - HKLM\..\Run: [RegisterDropHandler] C:\PROGRA~1\TEXTBR~1.0\Bin\REGIST~1.EXE
O4 - HKLM\..\Run: [InstantAccess] C:\PROGRA~1\TEXTBR~1.0\Bin\INSTAN~1.EXE /h
O4 - HKLM\..\Run: [DeskAd Service] C:\Program Files\DeskAd Service\DeskAdServ.exe
O4 - HKLM\..\Run: [B.tmp] C:\DOCUME~1\TIMS~1\LOCALS~1\Temp\B.tmp.exe 0 28129
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exe
O4 - HKLM\..\Run: [sais] c:\program files\180solutions\sais.exe
O4 - HKLM\..\Run: [WebRebates0] "C:\Program Files\Web_Rebates\WebRebates0.exe"
O4 - HKLM\..\Run: [Windows AdStatus] C:\Program Files\Windows AdStatus\WinStat.exe
O4 - HKLM\..\Run: [msva32.exe] C:\WINDOWS\system32\msva32.exe
O4 - HKLM\..\Run: [bK1rhTfE] C:\WINDOWS\wolngeoj.exe
O4 - HKLM\..\RunServices: [RegisterDropHandler] C:\PROGRA~1\TEXTBR~1.0\Bin\REGIST~1.EXE
O4 - HKLM\..\RunOnce: [DELDIR0.EXE] "C:\DOCUME~1\TIMS~1\LOCALS~1\Temp\DELDIR0.EXE" "C:\Program Files\McAfee\McAfee Shared Components\Central"
O4 - HKLM\..\RunOnce: [djtopr1150.exe] "C:\DOCUME~1\TIMS~1\LOCALS~1\Temp\djtopr1150.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe"
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~2\PSFree.exe"
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: ScanPanel.lnk = C:\Program Files\ePlus48U\ScanPanel\ScnPanel.exe
O8 - Extra context menu item: Web Rebates - file://C:\Program Files\Web_Rebates\Sy1150\Tp1150\scri1150a.htm
O9 - Extra button: SideFind - {10E42047-DEB9-4535-A118-B3F6EC39B807} - C:\Program Files\SideFind\sidefind.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.optonline.net
O15 - Trusted Zone: *.05p.com
O15 - Trusted Zone: *.awmdabest.com
O15 - Trusted Zone: *.blazefind.com
O15 - Trusted Zone: *.clickspring.net
O15 - Trusted Zone: *.flingstone.com
O15 - Trusted Zone: *.frame.crazywinnings.com
O15 - Trusted Zone: *.mt-download.com
O15 - Trusted Zone: *.my-internet.info
O15 - Trusted Zone: *.scoobidoo.com
O15 - Trusted Zone: *.searchbarcash.com
O15 - Trusted Zone: *.searchmiracle.com
O15 - Trusted Zone: *.slotch.com
O15 - Trusted Zone: *.static.topconverting.com
O15 - Trusted Zone: *.05p.com (HKLM)
O15 - Trusted Zone: *.awmdabest.com (HKLM)
O15 - Trusted Zone: *.blazefind.com (HKLM)
O15 - Trusted Zone: *.clickspring.net (HKLM)
O15 - Trusted Zone: *.flingstone.com (HKLM)
O15 - Trusted Zone: *.frame.crazywinnings.com (HKLM)
O15 - Trusted Zone: *.mt-download.com (HKLM)
O15 - Trusted Zone: *.my-internet.info (HKLM)
O15 - Trusted Zone: *.scoobidoo.com (HKLM)
O15 - Trusted Zone: *.searchbarcash.com (HKLM)
O15 - Trusted Zone: *.searchmiracle.com (HKLM)
O15 - Trusted Zone: *.slotch.com (HKLM)
O15 - Trusted Zone: *.static.topconverting.com (HKLM)
O15 - Trusted IP range: 206.161.125.149
O15 - Trusted IP range: 206.161.124.130 (HKLM)
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/CDTInc/ie/bridge-c46.cab
O16 - DPF: {386A771C-E96A-421F-8BA7-32F1B706892F} (Installer Class) - http://www.xxxtoolbar.com/ist/softwares/v4.0/0006_adult.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200203…meInstaller.exe
O23 - Service: Symantec Event Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: LexBce Server - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Norton AntiVirus Auto Protect Service - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Unerase Protection - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
O23 - Service: ScriptBlocking Service - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~2\SPEEDD~1\nopdb.exe
O23 - Service: SymWMI Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: Remote Procedure Call (RPC) Helper - Unknown - C:\WINDOWS\system32\ntnn32.exe

Mr. C,

Sorry for the errors. This filter is new to me. Please bare with me.

Here is a new HJT and Service Filter log. I'm giving you the contents of all folders of the service filter log. I hope this is it. I read the directions that came with the download thoroughly. The first log is from the Wordpad that pop's-up after the program is run and the second two are from the "On Request Only" folder. If it's not there than maybe the program is screwy? Please let me know if ok or not.

Thanks Greatly,

Tim



Logfile of HijackThis v1.99.0
Scan saved at 9:41:47 PM, on 1/30/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\WINDOWS\System32\qttask.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\Creative\ShareDLL\CtNotify.exe
C:\PROGRA~1\TEXTBR~1.0\Bin\INSTAN~1.EXE
C:\Program Files\Creative\ShareDLL\MediaDet.Exe
C:\DOCUME~1\TIMS~1\LOCALS~1\Temp\B.tmp.exe
C:\Program Files\ISTsvc\istsvc.exe
C:\Program Files\Web_Rebates\WebRebates0.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Windows AdStatus\WinStat.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\WINDOWS\system32\msva32.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\Program Files\Windows AdStatus\WinStatKeep.exe
C:\PROGRA~1\PANICW~1\POP-UP~2\PSFree.exe
C:\Program Files\ePlus48U\ScanPanel\ScnPanel.exe
C:\PROGRA~1\NORTON~2\SPEEDD~1\nopdb.exe
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\system32\ntnn32.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\Program Files\Web_Rebates\WebRebates1.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\DOCUME~1\TIMS~1\LOCALS~1\Temp\Temporary Directory 4 for hijackthis.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\zpjjb.dll/sp.html#28129
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\zpjjb.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\zpjjb.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\zpjjb.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\zpjjb.dll/sp.html#28129
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\zpjjb.dll/sp.html#28129
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\zpjjb.dll/sp.html#28129
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Optimum Online
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {B4126314-CC73-79E1-D2AC-CA3BC0E2B1EC} - C:\WINDOWS\system32\sdkny.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: ISTbar - {5F1ABCDB-A875-46c1-8345-B72A4567E486} - C:\PROGRA~1\ISTbar\istbar.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [POINTER] C:\Program Files\Microsoft Hardware\Mouse\point32.exe
O4 - HKLM\..\Run: [QuickTime Task] C:\WINDOWS\System32\qttask.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [Disc Detector] C:\Program Files\Creative\ShareDLL\CtNotify.exe
O4 - HKLM\..\Run: [RegisterDropHandler] C:\PROGRA~1\TEXTBR~1.0\Bin\REGIST~1.EXE
O4 - HKLM\..\Run: [InstantAccess] C:\PROGRA~1\TEXTBR~1.0\Bin\INSTAN~1.EXE /h
O4 - HKLM\..\Run: [DeskAd Service] C:\Program Files\DeskAd Service\DeskAdServ.exe
O4 - HKLM\..\Run: [B.tmp] C:\DOCUME~1\TIMS~1\LOCALS~1\Temp\B.tmp.exe 0 28129
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exe
O4 - HKLM\..\Run: [sais] c:\program files\180solutions\sais.exe
O4 - HKLM\..\Run: [WebRebates0] "C:\Program Files\Web_Rebates\WebRebates0.exe"
O4 - HKLM\..\Run: [Windows AdStatus] C:\Program Files\Windows AdStatus\WinStat.exe
O4 - HKLM\..\Run: [msva32.exe] C:\WINDOWS\system32\msva32.exe
O4 - HKLM\..\Run: [B.tmp.exe] C:\DOCUME~1\TIMS~1\LOCALS~1\Temp\B.tmp.exe 1 28129
O4 - HKLM\..\RunServices: [RegisterDropHandler] C:\PROGRA~1\TEXTBR~1.0\Bin\REGIST~1.EXE
O4 - HKLM\..\RunOnce: [DELDIR0.EXE] "C:\DOCUME~1\TIMS~1\LOCALS~1\Temp\DELDIR0.EXE" "C:\Program Files\McAfee\McAfee Shared Components\Central"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe"
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~2\PSFree.exe"
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: ScanPanel.lnk = C:\Program Files\ePlus48U\ScanPanel\ScnPanel.exe
O8 - Extra context menu item: Web Rebates - file://C:\Program Files\Web_Rebates\Sy1150\Tp1150\scri1150a.htm
O9 - Extra button: SideFind - {10E42047-DEB9-4535-A118-B3F6EC39B807} - C:\Program Files\SideFind\sidefind.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.optonline.net
O15 - Trusted Zone: *.05p.com
O15 - Trusted Zone: *.awmdabest.com
O15 - Trusted Zone: *.blazefind.com
O15 - Trusted Zone: *.clickspring.net
O15 - Trusted Zone: *.flingstone.com
O15 - Trusted Zone: *.frame.crazywinnings.com
O15 - Trusted Zone: *.mt-download.com
O15 - Trusted Zone: *.my-internet.info
O15 - Trusted Zone: *.scoobidoo.com
O15 - Trusted Zone: *.searchbarcash.com
O15 - Trusted Zone: *.searchmiracle.com
O15 - Trusted Zone: *.slotch.com
O15 - Trusted Zone: *.static.topconverting.com
O15 - Trusted Zone: *.xxxtoolbar.com
O15 - Trusted Zone: *.05p.com (HKLM)
O15 - Trusted Zone: *.awmdabest.com (HKLM)
O15 - Trusted Zone: *.blazefind.com (HKLM)
O15 - Trusted Zone: *.clickspring.net (HKLM)
O15 - Trusted Zone: *.flingstone.com (HKLM)
O15 - Trusted Zone: *.frame.crazywinnings.com (HKLM)
O15 - Trusted Zone: *.mt-download.com (HKLM)
O15 - Trusted Zone: *.my-internet.info (HKLM)
O15 - Trusted Zone: *.scoobidoo.com (HKLM)
O15 - Trusted Zone: *.searchbarcash.com (HKLM)
O15 - Trusted Zone: *.searchmiracle.com (HKLM)
O15 - Trusted Zone: *.slotch.com (HKLM)
O15 - Trusted Zone: *.static.topconverting.com (HKLM)
O15 - Trusted Zone: *.xxxtoolbar.com (HKLM)
O15 - Trusted IP range: 206.161.125.149
O15 - Trusted IP range: 206.161.124.130 (HKLM)
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/CDTInc/ie/bridge-c46.cab
O16 - DPF: {386A771C-E96A-421F-8BA7-32F1B706892F} (Installer Class) - http://www.xxxtoolbar.com/ist/softwares/v4.0/0006_adult.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200203…meInstaller.exe
O23 - Service: Symantec Event Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: LexBce Server - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Norton AntiVirus Auto Protect Service - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Unerase Protection - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
O23 - Service: ScriptBlocking Service - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~2\SPEEDD~1\nopdb.exe
O23 - Service: SymWMI Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: Remote Procedure Call (RPC) Helper - Unknown - C:\WINDOWS\system32\ntnn32.exe





The script did not recognize the services listed below.
This does not mean that they are a problem.

To copy the entire contents of this document for posting:
At the top of this window click "Edit" then "Select All"
Next click "Edit" again then "Copy"
Now right click in the forum post box then click "Paste"

########################################

ServiceFilter 1.1
by rand1038

Microsoft Windows XP Home Edition
Version: 5.1.2600 Service Pack 2
Jan 30, 2005 9:45:51 PM


There are 43 Win32 services on this machine.
All were recognized as legitimate.

Script Execution Time: 20.14063 seconds.







##################
Building Filter
##################
NameLine: Alerter
PathLine: "c:\windows\system32\svchost.exe -k localservice"
NameLine: ALG
PathLine: "c:\windows\system32\alg.exe"
NameLine: AppMgmt
PathLine: "c:\windows\system32\svchost.exe -k netsvcs"
NameLine: AudioSrv
PathLine: "c:\windows\system32\svchost.exe -k netsvcs"
NameLine: AvgServ
PathLine: "c:\progra~1\grisoft\avg6\avgserv.exe" "c:\program files\grisoft\avg6\avgserv.exe"
NameLine: BITS
PathLine: "c:\windows\system32\svchost.exe -k netsvcs"
NameLine: Browser
PathLine: "c:\windows\system32\svchost.exe -k netsvcs"
NameLine: CiSvc
PathLine: "c:\windows\system32\cisvc.exe"
NameLine: ClipSrv
PathLine: "c:\windows\system32\clipsrv.exe"
NameLine: COMSysApp
PathLine: "c:\windows\system32\dllhost.exe /processid:" "c:\windows\system32\dllhost.exe /processid:{02d4b3f1-fd88-11d1-960d-00805fc79235}"
NameLine: CryptSvc
PathLine: "c:\windows\system32\svchost.exe -k netsvcs"
NameLine: DcomLaunch
PathLine: "c:\windows\system32\svchost -k dcomlaunch"
NameLine: Dhcp
PathLine: "c:\windows\system32\svchost.exe -k netsvcs"
NameLine: dmadmin
PathLine: "c:\windows\system32\dmadmin.exe /com"
NameLine: dmserver
PathLine: "c:\windows\system32\svchost.exe -k netsvcs"
NameLine: Dnscache
PathLine: "c:\windows\system32\svchost.exe -k networkservice"
NameLine: ERSvc
PathLine: "c:\windows\system32\svchost.exe -k netsvcs"
NameLine: Eventlog
PathLine: "c:\windows\system32\services.exe"
NameLine: EventSystem
PathLine: "c:\windows\system32\svchost.exe -k netsvcs"
NameLine: FastUserSwitchingCompatibility
PathLine: "c:\windows\system32\svchost.exe -k netsvcs"
NameLine: GhostStartService
PathLine: "c:\progra~1\norton~1\norton~1\ghosts~2.exe" "c:\program files\norton systemworks\norton ghost\ghoststarttrayapp.exe" "c:\progra~1\norton~1\norton~2\ghosts~2.exe"
NameLine: helpsvc
PathLine: "c:\windows\system32\svchost.exe -k netsvcs"
NameLine: HidServ
PathLine: "c:\windows\system32\svchost.exe -k netsvcs"
NameLine: HTTPFilter
PathLine: "c:\windows\system32\svchost.exe -k httpfilter"
NameLine: ImapiService
PathLine: "c:\windows\system32\imapi.exe"
NameLine: LanmanServer
PathLine: "c:\windows\system32\svchost.exe -k netsvcs"
NameLine: LanmanWorkstation
PathLine: "c:\windows\system32\svchost.exe -k netsvcs"
NameLine: LmHosts
PathLine: "c:\windows\system32\svchost.exe -k localservice"
NameLine: Messenger
PathLine: "c:\windows\system32\svchost.exe -k netsvcs"
NameLine: mnmsrvc
PathLine: "c:\windows\system32\mnmsrvc.exe"
NameLine: MSDTC
PathLine: "c:\windows\system32\msdtc.exe"
NameLine: MSIServer
PathLine: "c:\windows\system32\msiexec.exe /v"
NameLine: NetDDE
PathLine: "c:\windows\system32\netdde.exe"
NameLine: NetDDEdsdm
PathLine: "c:\windows\system32\netdde.exe"
NameLine: Netlogon
PathLine: "c:\windows\system32\lsass.exe"
NameLine: Netman
PathLine: "c:\windows\system32\svchost.exe -k netsvcs"
NameLine: Nla
PathLine: "c:\windows\system32\svchost.exe -k netsvcs"
NameLine: NtLmSsp
PathLine: "c:\windows\system32\lsass.exe"
NameLine: NtmsSvc
PathLine: "c:\windows\system32\svchost.exe -k netsvcs"
NameLine: PlugPlay
PathLine: "c:\windows\system32\services.exe"
NameLine: PolicyAgent
PathLine: "c:\windows\system32\lsass.exe"
NameLine: ProtectedStorage
PathLine: "c:\windows\system32\lsass.exe"
NameLine: RasAuto
PathLine: "c:\windows\system32\svchost.exe -k netsvcs"
NameLine: RasMan
PathLine: "c:\windows\system32\svchost.exe -k netsvcs"
NameLine: RDSessMgr
PathLine: "c:\windows\system32\sessmgr.exe"
NameLine: RemoteAccess
PathLine: "c:\windows\system32\svchost.exe -k netsvcs"
NameLine: RpcLocator
PathLine: "c:\windows\system32\locator.exe"
NameLine: RpcSs
PathLine: "c:\windows\system32\svchost -k rpcss"
NameLine: RSVP
PathLine: "c:\windows\system32\rsvp.exe"
NameLine: SamSs
PathLine: "c:\windows\system32\lsass.exe"
NameLine: SCardSvr
PathLine: "c:\windows\system32\scardsvr.exe"
NameLine: Schedule
PathLine: "c:\windows\system32\svchost.exe -k netsvcs"
NameLine: seclogon
PathLine: "c:\windows\system32\svchost.exe -k netsvcs"
NameLine: SENS
PathLine: "c:\windows\system32\svchost.exe -k netsvcs"
NameLine: SharedAccess
PathLine: "c:\windows\system32\svchost.exe -k netsvcs"
NameLine: ShellHWDetection
PathLine: "c:\windows\system32\svchost.exe -k netsvcs"
NameLine: SmcService
PathLine: "c:\program files\sygate\spf\smc.exe" "c:\programmer\sygate\spf\smc.exe"
NameLine: Speed Disk service
PathLine: "c:\program files\norton systemworks\speed disk\nopdb.exe" "c:\progra~1\norton~1\norton~2\speedd~1\nopdb.exe" "c:\programmer\speed disk\nopdb.exe" "c:\progra~1\norton~1\speedd~1\nopdb.exe"
NameLine: Spooler
PathLine: "c:\windows\system32\spoolsv.exe"
NameLine: srservice
PathLine: "c:\windows\system32\svchost.exe -k netsvcs"
NameLine: SSDPSRV
PathLine: "c:\windows\system32\svchost.exe -k localservice"
NameLine: stisvc
PathLine: "c:\windows\system32\svchost.exe -k imgsvc"
NameLine: SwPrv
PathLine: "c:\windows\system32\dllhost.exe /processid:" "c:\windows\system32\dllhost.exe /processid:{41ddad54-1a04-4eee-add8-1265e0961408}" "c:\windows\system32\dllhost.exe /processid:{35367339-dc8f-4fc3-968c-f9df741d4dbe}" "c:\windows\system32\dllhost.exe /processid:{9bc5b651-952c-4947-ac46-563d2749c8a0}" "c:\windows\system32\dllhost.exe /processid:{623ffd12-22a4-493a-849e-b18b08b6d1fd}" "c:\windows\system32\dllhost.exe /processid:{fb5d9a43-1804-43b6-9def-454dd2c27335}" "c:\windows\system32\dllhost.exe /processid:{a1b7c37e-2066-4197-aef1-8e74a4277c4f}" "c:\windows\system32\dllhost.exe /processid:{99f0c999-bd16-4d56-8ee1-3ea1e9c76530}" "c:\windows\system32\dllhost.exe /processid:{19fafb4b-9793-4e18-bb2d-f0a84408002f}" "c:\windows\system32\dllhost.exe /processid:{1dec404a-448f-4d78-99ab-e0abe8543fb8}" "c:\windows\system32\dllhost.exe/processid:{623ffd12-22a4-493a-849e-b18b08b6d1fd}" "c:\windows\system32\dllhost.exe /processid:{2ff4bec0-1924-4bdf-bb94-ef3c93544167}" "c:\windows\system32\dllhost.exe /processid:{ee3322e8-ed2c-4788-bb16-70cb603bc2eb}" "c:\windows\system32\dllhost.exe /processid:{54a4c521-4615-4199-916e-e712c247c8a3}" "c:\windows\system32\dllhost.exe /processid:{2351025a-779a-4ed3-b9c0-7d9937d43346}" "c:\windows\system32\dllhost.exe /processid:{37752eee-49dd-486b-a6f2-9f9075d9037d}" "c:\windows\system32\dllhost.exe /processid:{d2aabb10-5220-4073-965f-2bdc556855c8}" "c:\windows\system32\dllhost.exe /processid:{8fee7177-83f4-4b14-bf06-950d1b4b8916}" "c:\windows\system32\dllhost.exe /processid:{49dc589b-b367-45ec-a9d9-71b4a3b5dc03}"
NameLine: SysmonLog
PathLine: "c:\windows\system32\smlogsvc.exe"
NameLine: TapiSrv
PathLine: "c:\windows\system32\svchost.exe -k netsvcs"
NameLine: TermService
PathLine: "c:\windows\system32\svchost -k dcomlaunch" "c:\windows\system32\svchost.exe -k netsvcs"
NameLine: Themes
PathLine: "c:\windows\system32\svchost.exe -k netsvcs"
NameLine: TrkWks
PathLine: "c:\windows\system32\svchost.exe -k netsvcs"
NameLine: UMWdf
PathLine: "c:\windows\system32\wdfmgr.exe"
NameLine: upnphost
PathLine: "c:\windows\system32\svchost.exe -k localservice"
NameLine: UPS
PathLine: "c:\windows\system32\ups.exe"
NameLine: VMAuthdService
PathLine: "c:\program files\vmware\vmware workstation\vmware-authd.exe" "c:\progra~1\vmware\vmware~1\vmware~1.exe"
NameLine: VMnetDHCP
PathLine: "c:\windows\system32\vmnetdhcp.exe" "c:\windows\system32\vmnetd~1.exe"
NameLine: VMware NAT Service
PathLine: "c:\windows\system32\vmnat.exe"
NameLine: VSS
PathLine: "c:\windows\system32\vssvc.exe"
NameLine: W32Time
PathLine: "c:\windows\system32\svchost.exe -k netsvcs"
NameLine: WebClient
PathLine: "c:\windows\system32\svchost.exe -k localservice"
NameLine: winmgmt
PathLine: "c:\windows\system32\svchost.exe -k netsvcs"
NameLine: WMDM PMSP Service
PathLine: "c:\windows\system32\mspmspsv.exe"
NameLine: WmdmPmSN
PathLine: "c:\windows\system32\svchost.exe -k netsvcs"
NameLine: WmiApSrv
PathLine: "c:\windows\system32\wbem\wmiapsrv.exe"
NameLine: wscsvc
PathLine: "c:\windows\system32\svchost.exe -k netsvcs"
NameLine: wuauserv
PathLine: "c:\windows\system32\svchost.exe -k netsvcs"
NameLine: WZCSVC
PathLine: "c:\windows\system32\svchost.exe -k netsvcs"
NameLine: xmlprov
PathLine: "c:\windows\system32\svchost.exe -k netsvcs"
NameLine: SCardDrv
PathLine: "c:\windows\system32\scardsvr.exe"
NameLine: uploadmgr
PathLine: "c:\windows\system32\svchost.exe -k netsvcs"
NameLine: WmdmPmSp
PathLine: "c:\windows\system32\svchost.exe -k netsvcs"
NameLine: aspnet_state
PathLine: "c:\windows\microsoft.net\framework\v1.1.4322\aspnet_state.exe"
NameLine: Fax
PathLine: "c:\windows\system32\fxssvc.exe"
NameLine: Iprip
PathLine: "c:\windows\system32\svchost.exe -k netsvcs"
NameLine: ose
PathLine: "c:\program files\common files\microsoft shared\source engine\ose.exe" "c:\programmer\fælles filer\microsoft shared\source engine\ose.exe" "c:\progra~1\common~1\micros~1\source~1\ose.exe"
NameLine: SimpTcp
PathLine: "c:\windows\system32\tcpsvcs.exe"
NameLine: SNMP
PathLine: "c:\windows\system32\snmp.exe"
NameLine: SNMPTRAP
PathLine: "c:\windows\system32\snmptrap.exe"
NameLine: VetMsgNT
PathLine: "c:\windows\system32\vetmsgnt.exe" "c:\progra~1\ca\etrust~1\etrust~1\vetmsg.exe"
NameLine: vsmon
PathLine: "c:\windows\system32\zonelabs\vsmon.exe -service"
NameLine: Ati HotKey Poller
PathLine: "c:\windows\system32\atievxx.exe" "c:\windows\system32\ati2evxx.exe"
NameLine: Ip6FwHlp
PathLine: "c:\windows\system32\svchost.exe -k netsvcs"
NameLine: AcrSch2Svc
PathLine: "c:\program files\common files\acronis\schedule2\schedul2.exe" "c:\programmer\fælles filer\acronis\schedule2\schedul2.exe"
NameLine: ccEvtMgr
PathLine: "c:\program files\common files\symantec shared\ccevtmgr.exe"
NameLine: ccPwdSvc
PathLine: "c:\program files\common files\symantec shared\ccpwdsvc.exe"
NameLine: F-Prot Antivirus Update Monitor
PathLine: "c:\program files\fsi\f-prot\fpavupdm.exe"
NameLine: NVSvc
PathLine: "c:\windows\system32\nvsvc32.exe"
NameLine: AOL ACS
PathLine: "c:\progra~1\common~1\aol\acs\acsd.exe" "c:\progra~1\common~1\aol\acs\aolacsd.exe"
NameLine: WANMiniportService
PathLine: "c:\windows\wanmpsvc.exe"
NameLine: LexBceS
PathLine: "c:\windows\system32\lexbces.exe"
NameLine: NetSvc
PathLine: "c:\program files\intel\ncs\sync\netsvc.exe"
NameLine: ATI Smart
PathLine: "c:\windows\system32\ati2sgag.exe"
NameLine: BlackICE
PathLine: "c:\program files\iss\blackice\blackd.exe" "c:\iss\blackice\blackd.exe"
NameLine: iPodService
PathLine: "c:\program files\ipod\bin\ipodservice.exe" "c:\programmer\ipod\bin\ipodservice.exe"
NameLine: LicCtrlService
PathLine: "c:\windows\runservice.exe"
NameLine: RadClock
PathLine: "c:\windows\system32\radclock.exe" "c:\programmer\radlinker\radclock.exe"
NameLine: RapApp
PathLine: "c:\program files\iss\blackice\rapapp.exe" "c:\iss\blackice\rapapp.exe"
NameLine: rpcapd
PathLine: "c:\program files\winpcap\rpcapd.exe -d -f c:\program files\winpcap\rpcapd.ini"
NameLine: ccExtractorService
PathLine: "c:\program files\symantec\deepsight extractor\ccextractorservice.exe"
NameLine: DeepsightExtractor
PathLine: "c:\program files\symantec\deepsight extractor\extractorservice.exe"
NameLine: GEARSecurity
PathLine: "c:\windows\system32\gearsec.exe"
NameLine: YPCService
PathLine: "c:\windows\system32\ypcser~1.exe"
NameLine: Macromedia Licensing Service
PathLine: "c:\program files\common files\macromedia shared\service\macromedia licensing.exe"
NameLine: MDM
PathLine: "c:\program files\common files\microsoft shared\vs7debug\mdm.exe" "c:\programmer\fælles filer\microsoft shared\vs7debug\mdm.exe"
NameLine: navapsvc
PathLine: "c:\program files\norton systemworks\norton antivirus\navapsvc.exe" "c:\program files\norton internet security\norton antivirus\navapsvc.exe" "c:\program files\norton antivirus\navapsvc.exe"
NameLine: NProtectService
PathLine: "c:\program files\norton systemworks\norton utilities\nprotect.exe" "c:\progra~1\norton~1\norton~2\nprotect.exe" "c:\programmer\norton utilities\nprotect.exe"
NameLine: SBService
PathLine: "c:\progra~1\common~1\symant~1\script~1\sbserv.exe"
NameLine: InCDsrv
PathLine: "c:\program files\ahead\incd\incdsrv.exe" "c:\programmer\ahead\incd\incdsrv.exe"
NameLine: PrismXL
PathLine: "c:\program files\common files\lanovation\prismxl\prismxl.sys"
NameLine: ccSetMgr
PathLine: "c:\program files\common files\symantec shared\ccsetmgr.exe"
NameLine: Creative Service for CDROM Access
PathLine: "c:\windows\system32\ctsvccda.exe"
NameLine: RemoteRegistry
PathLine: "c:\windows\system32\svchost.exe -k localservice"
NameLine: SAVScan
PathLine: "c:\program files\norton systemworks\norton antivirus\savscan.exe" "c:\program files\norton internet security\norton antivirus\savscan.exe"
NameLine: Symantec Core LC
PathLine: "c:\program files\common files\symantec shared\ccpd-lc\symlcsvc.exe"
NameLine: SymWSC
PathLine: "c:\program files\common files\symantec shared\security center\symwsc.exe"
NameLine: TlntSvr
PathLine: "c:\windows\system32\tlntsvr.exe"
NameLine: Wmi
PathLine: "c:\windows\system32\svchost.exe -k netsvcs"
NameLine: aswUpdSv
PathLine: "c:\programmer\alwil software\avast4\aswupdsv.exe" "c:\program files\alwil software\avast4\aswupdsv.exe"
NameLine: avast! Antivirus
PathLine: "c:\programmer\alwil software\avast4\ashserv.exe" "c:\program files\alwil software\avast4\ashserv.exe"
NameLine: SLService
PathLine: "c:serv.exe"
NameLine: Pml Driver HPZ12
PathLine: "c:\windows\system32\hpzipm12.exe"
NameLine: cusrvc
PathLine: "c:\arbejdscomp\nwclient32\xp\winnt\i386\redir\cusrvc.exe"
NameLine: CVPND
PathLine: "c:\programmer\cisco systems\vpn client\cvpnd.exe"
NameLine: NALNTSERVICE
PathLine: "c:\programmer\novell\zenworks\nalntsrv.exe"
NameLine: Prometheus Wake-On-LAN Status Agent
PathLine: "c:\programmer\novell\zenworks\remotemanagement\rmagent\wolsernt.exe"
NameLine: Remote Management Agent
PathLine: "c:\programmer\novell\zenworks\remotemanagement\rmagent\zenrem32.exe"
NameLine: SweepNet
PathLine: "c:\programmer\sophos sweep for nt\swnetsup.exe" "c:\program files\sophos sweep for nt\swnetsup.exe"
NameLine: SWEEPSRV.SYS
PathLine: "c:\programmer\sophos sweep for nt\sweepsrv.sys" "c:\program files\sophos sweep for nt\sweepsrv.sys"
NameLine: WebrootCommAgentService
PathLine: "c:\programmer\webroot\enterprise\commagent\commagent.exe"
NameLine: WebrootSpySweeperService
PathLine: "c:\programmer\webroot\enterprise\spy sweeper\spysweeper.exe"
NameLine: ZFDWM
PathLine: "c:\programmer\novell\zenworks\wm.exe"
NameLine: CA_LIC_CLNT
PathLine: "c:\programmer\ca\sharedcomponents\ca_lic\lic98rmt.exe"
NameLine: CA_LIC_SRVR
PathLine: "c:\programmer\ca\sharedcomponents\ca_lic\lic98rmtd.exe"
NameLine: FirewallService
PathLine: "c:\progra~1\bitguard\firewall\firesvc.exe"
NameLine: Irmon
PathLine: "c:\windows\system32\svchost.exe -k netsvcs"
NameLine: LogWatch
PathLine: "c:\programmer\ca\sharedcomponents\ca_lic\logwatnt.exe"
NameLine: x10nets
PathLine: "c:\progra~1\common~1\x10\common\x10nets.exe" "c:\progra~1\atimul~1\remctrl\x10nets.exe"
NameLine: NipSvc
PathLine: "c:\programmer\norman\nvc\bin\nipsvc.exe" "c:\norman\nvc\bin\nipsvc.exe"
NameLine: Norman NJeeves
PathLine: "c:\programmer\norman\nvc\bin\njeeves.exe" "c:\norman\nvc\bin\njeeves.exe"
NameLine: Norman ZANDA
PathLine: "c:\programmer\norman\nvc\bin\zanda.exe" "c:\norman\nvc\bin\zanda.exe"
NameLine: nvcoas
PathLine: "c:\programmer\norman\nvc\bin\nvcoas.exe" "c:\norman\nvc\bin\nvcoas.exe"
NameLine: NVCScheduler
PathLine: "c:\programmer\norman\nvc\bin\nvcsched.exe" "c:\norman\nvc\bin\nvcsched.exe"
NameLine: navi
PathLine: "c:\programmer\verisign\navi\naviagent.exe manifest=https://manifest.verisign-grs.com/manifestnt_414.xml guid={b562bc94-9a3a-4760-ae48-0d52fd01b1b5} interface={3feff9f3-b5f5-4f47-bb96-ce281bfbe15d}"
NameLine: VMTools
PathLine: "c:\program files\vmware\vmware tools\vmwareservice.exe"
NameLine: PersFw
PathLine: "c:\program files\kerio\personal firewall\persfw.exe"
NameLine: StyleXPService
PathLine: "c:\program files\tgtsoft\stylexp\stylexpservice.exe"
NameLine: aksrvnt
PathLine: "c:\windows\system32\aksrvnt.exe"
NameLine: qfcoresvc
PathLine: "c:\program files\pivx\qwik-fix\qfloadsvc.exe"
NameLine: nhksrv
PathLine: "c:\program files\netropa\multimedia keyboard\nhksrv.exe"
NameLine: PDEngine
PathLine: "c:\program files\raxco\perfectdisk\pdengine.exe"
NameLine: PDSched
PathLine: "c:\program files\raxco\perfectdisk\pdsched.exe"
NameLine: ssoftservice
PathLine: "c:oftsrv.exe"
NameLine: DefWatch
PathLine: "c:\programmer\navnt\defwatch.exe" "c:\program files\symantec_client_security\symantec antivirus\defwatch.exe"
NameLine: Intel File Transfer
PathLine: "c:\windows\system32\cba\xfr.exe"
NameLine: Intel PDS
PathLine: "c:\windows\system32\cba\pds.exe"
NameLine: Norton AntiVirus Server
PathLine: "c:\programmer\navnt\rtvscan.exe" "c:\program files\symantec_client_security\symantec antivirus\rtvscan.exe"
NameLine: WinVNC4
PathLine: "c:\programmer\realvnc\vnc4\winvnc4.exe -service"
NameLine: Avg7Alrt
PathLine: "c:\grisoft\avg7\avgamsvr.exe" "c:\progra~1\grisoft\avgfre~1\avgamsvr.exe" "c:\progra~1\grisoft\avg7\avgamsvr.exe"
NameLine: Avg7UpdSvc
PathLine: "c:\grisoft\avg7\avgupsvc.exe" "c:\progra~1\grisoft\avgfre~1\avgupsvc.exe" "c:\progra~1\grisoft\avg7\avgupsvc.exe"
NameLine: EPSONStatusAgent2
PathLine: "c:\program files\common files\epson\ebapi\sagent2.exe"
NameLine: Pctspk
PathLine: "c:\windows\system32\pctspk.exe"
NameLine: APC UPS Service
PathLine: "c:\program files\apc\apc powerchute personal edition\mainserv.exe"
NameLine: winvnc
PathLine: "c:\program files\realvnc\winvnc\winvnc.exe -service"
NameLine: 6to4
PathLine: "c:\windows\system32\svchost.exe -k netsvcs"
NameLine: Autodata Limited License Service
PathLine: "c:\program files\common files\autodata limited shared\service\adcdlicsvc.exe"
NameLine: NwSapAgent
PathLine: "c:\windows\system32\svchost.exe -k netsvcs"
NameLine: PREVXAgent
PathLine: "c:\program files\prevx\prevx home\pxagent.exe -f -af"
NameLine: V2i Protector
PathLine: "c:\program files\powerquest\drive image 7.0\agent\pqv2isvc.exe"
NameLine: McShield
PathLine: "c:\progra~1\mcafee.com\vso\mcshield.exe"
NameLine: mcupdmgr.exe
PathLine: "c:\progra~1\mcafee.com\agent\mcupdmgr.exe"
NameLine: MCVSRte
PathLine: "c:\progra~1\mcafee.com\vso\mcvsrte.exe /embedding"
NameLine: ccProxy
PathLine: "c:\program files\common files\symantec shared\ccproxy.exe"
NameLine: ehSched
PathLine: "c:\windows\ehome\ehsched.exe"
NameLine: SNDSrvc
PathLine: "c:\program files\common files\symantec shared\sndsrvc.exe"
NameLine: WmcCdsLs
PathLine: "c:\program files\windows media connect\mswmcls.exe"
NameLine: OODefrag
PathLine: "c:\windows\system32\oodag.exe"
NameLine: KodakCCS
PathLine: "c:\windows\system32\drivers\kodakccs.exe"
NameLine: ScsiAccess
PathLine: "c:\windows\system32\scsiaccess.exe"
NameLine: CAISafe
PathLine: "c:\program files\ca\etrust ez armor\etrust ez antivirus\isafe.exe"
NameLine: eTrustVPN Services
PathLine: "c:\program files\etrust\vpn\evpnsvc.exe"
NameLine: Gilat QMS
PathLine: "c:\program files\gilat\qms\qms.exe"
NameLine: GilatHSU
PathLine: "c:\program files\gilat\gsu\gsu.exe"
NameLine: GilatNetAgent
PathLine: "c:\program files\gilat\netagent.exe"
NameLine: ibqossvc
PathLine: "c:\program files\gilat\ibqos\ibqossvc.exe"
NameLine: RPAService
PathLine: "c:\program files\gilat\internet page accelerator\rpaservice.exe"
NameLine: WgwService
PathLine: "c:\program files\flash networks\nettgain2000\bst\srvany.exe"
NameLine: Apache2
PathLine: "c:\apache group\apache2\bin\apache.exe -k runservice"
NameLine: IISADMIN
PathLine: "c:\windows\system32\inetsrv\inetinfo.exe"
NameLine: matlabserver
PathLine: "c:\matlab6p5\webserver\bin\win32\matlabserver.exe"
NameLine: MySql
PathLine: "c:/mysql/bin/mysqld-nt.exe"
NameLine: SMTPSVC
PathLine: "c:\windows\system32\inetsrv\inetinfo.exe"
NameLine: SPTimer
PathLine: "c:\program files\common files\microsoft shared\web server extensions\50\bin\owstimer.exe"
NameLine: Visual Studio Analyzer RPC bridge
PathLine: "c:\microsoft visual studio\common\tools\vs-ent98\vanalyzr\varpc.exe"
NameLine: W3SVC
PathLine: "c:\windows\system32\inetsrv\inetinfo.exe"
NameLine: Diskeeper
PathLine: "c:\program files\executive software\diskeeperworkstation\dkservice.exe"
NameLine: Pml Driver
PathLine: "c:\windows\system32\hphipm09.exe"
NameLine: SoundMAX Agent Service (default)
PathLine: "c:\program files\analog devices\soundmax\smagent.exe"
NameLine: UPSlim
PathLine: "c:\program files\belkin bulldog\upsd.exe"
NameLine: ccPxySvc
PathLine: "c:\program files\norton internet security\ccpxysvc.exe"
NameLine: Fix-It Task Manager
PathLine: "c:\progra~1\ontrack\fix-it\mxtask.exe -service"
NameLine: NISUM
PathLine: "c:\program files\norton internet security\nisum.exe"
NameLine: usprserv
PathLine: "c:\windows\system32\svchost.exe -k netsvcs"
####################
Done Building Filter
####################
stFiltFlag: name_path
Service Name: Alerter
Path Name: c:\windows\system32\svchost.exe -k localservice
PathNameMod: c:\windows\system32\svchost.exe -k localservice

stFiltFlag: name_path
Service Name: ALG
Path Name: c:\windows\system32\alg.exe
PathNameMod: c:\windows\system32\alg.exe

stFiltFlag: name_path
Service Name: AppMgmt
Path Name: c:\windows\system32\svchost.exe -k netsvcs
PathNameMod: c:\windows\system32\svchost.exe -k netsvcs

stFiltFlag: name_path
Service Name: aspnet_state
Path Name: c:\windows\microsoft.net\framework\v1.1.4322\aspnet_state.exe
PathNameMod: c:\windows\microsoft.net\framework\v1.1.4322\aspnet_state.exe

stFiltFlag: name_path
Service Name: AudioSrv
Path Name: c:\windows\system32\svchost.exe -k netsvcs
PathNameMod: c:\windows\system32\svchost.exe -k netsvcs

stFiltFlag: name_path
Service Name: BITS
Path Name: c:\windows\system32\svchost.exe -k netsvcs
PathNameMod: c:\windows\system32\svchost.exe -k netsvcs

stFiltFlag: name_path
Service Name: Browser
Path Name: c:\windows\system32\svchost.exe -k netsvcs
PathNameMod: c:\windows\system32\svchost.exe -k netsvcs

stFiltFlag: name_path
Service Name: ccEvtMgr
Path Name: c:\program files\common files\symantec shared\ccevtmgr.exe
PathNameMod: c:\program files\common files\symantec shared\ccevtmgr.exe

stFiltFlag: name_path
Service Name: cisvc
Path Name: c:\windows\system32\cisvc.exe
PathNameMod: c:\windows\system32\cisvc.exe

stFiltFlag: name_path
Service Name: ClipSrv
Path Name: c:\windows\system32\clipsrv.exe
PathNameMod: c:\windows\system32\clipsrv.exe

stFiltFlag: name_path
Service Name: COMSysApp
Path Name: c:\windows\system32\dllhost.exe /processid:{02d4b3f1-fd88-11d1-960d-00805fc79235}
PathNameMod: c:\windows\system32\dllhost.exe /processid:{02d4b3f1-fd88-11d1-960d-00805fc79235}

stFiltFlag: name_path
Service Name: Creative Service for CDROM Access
Path Name: c:\windows\system32\ctsvccda.exe
PathNameMod: c:\windows\system32\ctsvccda.exe

stFiltFlag: name_path
Service Name: CryptSvc
Path Name: c:\windows\system32\svchost.exe -k netsvcs
PathNameMod: c:\windows\system32\svchost.exe -k netsvcs

stFiltFlag: name_path
Service Name: DcomLaunch
Path Name: c:\windows\system32\svchost -k dcomlaunch
PathNameMod: c:\windows\system32\svchost -k dcomlaunch

stFiltFlag: name_path
Service Name: Dhcp
Path Name: c:\windows\system32\svchost.exe -k netsvcs
PathNameMod: c:\windows\system32\svchost.exe -k netsvcs

stFiltFlag: name_path
Service Name: dmadmin
Path Name: c:\windows\system32\dmadmin.exe /com
PathNameMod: c:\windows\system32\dmadmin.exe /com

stFiltFlag: name_path
Service Name: dmserver
Path Name: c:\windows\system32\svchost.exe -k netsvcs
PathNameMod: c:\windows\system32\svchost.exe -k netsvcs

stFiltFlag: name_path
Service Name: Dnscache
Path Name: c:\windows\system32\svchost.exe -k networkservice
PathNameMod: c:\windows\system32\svchost.exe -k networkservice

stFiltFlag: name_path
Service Name: ERSvc
Path Name: c:\windows\system32\svchost.exe -k netsvcs
PathNameMod: c:\windows\system32\svchost.exe -k netsvcs

stFiltFlag: name_path
Service Name: Eventlog
Path Name: c:\windows\system32\services.exe
PathNameMod: c:\windows\system32\services.exe

stFiltFlag: name_path
Service Name: EventSystem
Path Name: c:\windows\system32\svchost.exe -k netsvcs
PathNameMod: c:\windows\system32\svchost.exe -k netsvcs

stFiltFlag: name_path
Service Name: FastUserSwitchingCompatibility
Path Name: c:\windows\system32\svchost.exe -k netsvcs
PathNameMod: c:\windows\system32\svchost.exe -k netsvcs

stFiltFlag: name_path
Service Name: helpsvc
Path Name: c:\windows\system32\svchost.exe -k netsvcs
PathNameMod: c:\windows\system32\svchost.exe -k netsvcs

stFiltFlag: name_path
Service Name: HidServ
Path Name: c:\windows\system32\svchost.exe -k netsvcs
PathNameMod: c:\windows\system32\svchost.exe -k netsvcs

stFiltFlag: name_path
Service Name: HTTPFilter
Path Name: c:\windows\system32\svchost.exe -k httpfilter
PathNameMod: c:\windows\system32\svchost.exe -k httpfilter

stFiltFlag: name_path
Service Name: ImapiService
Path Name: c:\windows\system32\imapi.exe
PathNameMod: c:\windows\system32\imapi.exe

stFiltFlag: name_path
Service Name: lanmanserver
Path Name: c:\windows\system32\svchost.exe -k netsvcs
PathNameMod: c:\windows\system32\svchost.exe -k netsvcs

stFiltFlag: name_path
Service Name: lanmanworkstation
Path Name: c:\windows\system32\svchost.exe -k netsvcs
PathNameMod: c:\windows\system32\svchost.exe -k netsvcs

stFiltFlag: name_path
Service Name: LexBceS
Path Name: c:\windows\system32\lexbces.exe
PathNameMod: c:\windows\system32\lexbces.exe

stFiltFlag: name_path
Service Name: LmHosts
Path Name: c:\windows\system32\svchost.exe -k localservice
PathNameMod: c:\windows\system32\svchost.exe -k localservice

stFiltFlag: name_path
Service Name: Messenger
Path Name: c:\windows\system32\svchost.exe -k netsvcs
PathNameMod: c:\windows\system32\svchost.exe -k netsvcs

stFiltFlag: name_path
Service Name: mnmsrvc
Path Name: c:\windows\system32\mnmsrvc.exe
PathNameMod: c:\windows\system32\mnmsrvc.exe

stFiltFlag: name_path
Service Name: MSDTC
Path Name: c:\windows\system32\msdtc.exe
PathNameMod: c:\windows\system32\msdtc.exe

stFiltFlag: name_path
Service Name: MSIServer
Path Name: c:\windows\system32\msiexec.exe /v
PathNameMod: c:\windows\system32\msiexec.exe /v

stFiltFlag: name_path
Service Name: navapsvc
Path Name: "c:\program files\norton systemworks\norton antivirus\navapsvc.exe"
PathNameMod: c:\program files\norton systemworks\norton antivirus\navapsvc.exe

stFiltFlag: name_path
Service Name: NetDDE
Path Name: c:\windows\system32\netdde.exe
PathNameMod: c:\windows\system32\netdde.exe

stFiltFlag: name_path
Service Name: NetDDEdsdm
Path Name: c:\windows\system32\netdde.exe
PathNameMod: c:\windows\system32\netdde.exe

stFiltFlag: name_path
Service Name: Netlogon
Path Name: c:\windows\system32\lsass.exe
PathNameMod: c:\windows\system32\lsass.exe

stFiltFlag: name_path
Service Name: Netman
Path Name: c:\windows\system32\svchost.exe -k netsvcs
PathNameMod: c:\windows\system32\svchost.exe -k netsvcs

stFiltFlag: name_path
Service Name: Nla
Path Name: c:\windows\system32\svchost.exe -k netsvcs
PathNameMod: c:\windows\system32\svchost.exe -k netsvcs

stFiltFlag: name_path
Service Name: NProtectService
Path Name: "c:\program files\norton systemworks\norton utilities\nprotect.exe"
PathNameMod: c:\program files\norton systemworks\norton utilities\nprotect.exe

stFiltFlag: name_path
Service Name: NtLmSsp
Path Name: c:\windows\system32\lsass.exe
PathNameMod: c:\windows\system32\lsass.exe

stFiltFlag: name_path
Service Name: NtmsSvc
Path Name: c:\windows\system32\svchost.exe -k netsvcs
PathNameMod: c:\windows\system32\svchost.exe -k netsvcs


Script Execution Time: 20.14063 seconds.








###################################################

Please do not post the contents of this document
unless the person helping you specifically requests
to see Services.txt
Thank You

###################################################

ServiceFilter 1.1
by rand1038

Service Name: Alerter
Display Name: Alerter
Start Mode: Disabled
Start Name: NT AUTHORITY\LocalService
Description: Notifies selected users and computers of administrative alerts. If the service is stopped, …
Service Type: Share Process
Path: c:\windows\system32\svchost.exe -k localservice
State: Stopped
Process ID: 0
Started: False
Exit Code: 1077
Accept Pause: False
Accept Stop: False

Service Name: ALG
Display Name: Application Layer Gateway Service
Start Mode: Manual
Start Name: NT AUTHORITY\LocalService
Description: Provides support for 3rd party protocol plug-ins for Internet Connection Sharing and the Windows …
Service Type: Own Process
Path: c:\windows\system32\alg.exe
State: Running
Process ID: 2280
Started: True
Exit Code: 0
Accept Pause: False
Accept Stop: True

Service Name: AppMgmt
Display Name: Application Management
Start Mode: Manual
Start Name: LocalSystem
Description: Provides software installation services such as Assign, Publish, and …
Service Type: Share Process
Path: c:\windows\system32\svchost.exe -k netsvcs
State: Stopped
Process ID: 0
Started: False
Exit Code: 1077
Accept Pause: False
Accept Stop: False

Service Name: aspnet_state
Display Name: ASP.NET State Service
Start Mode: Manual
Start Name: NT AUTHORITY\NetworkService
Description: Provides support for out-of-process session states for ASP.NET. If this service is stopped, …
Service Type: Own Process
Path: c:\windows\microsoft.net\framework\v1.1.4322\aspnet_state.exe
State: Stopped
Process ID: 0
Started: False
Exit Code: 1077
Accept Pause: False
Accept Stop: False

Service Name: AudioSrv
Display Name: Windows Audio
Start Mode: Auto
Start Name: LocalSystem
Description: Manages audio devices for Windows-based programs. If this service is stopped, audio devices and …
Service Type: Share Process
Path: c:\windows\system32\svchost.exe -k netsvcs
State: Running
Process ID: 792
Started: True
Exit Code: 0
Accept Pause: False
Accept Stop: True

Service Name: BITS
Display Name: Background Intelligent Transfer Service
Start Mode: Manual
Start Name: LocalSystem
Description: Transfers files in the background using idle network bandwidth. If the service is stopped, …
Service Type: Share Process
Path: c:\windows\system32\svchost.exe -k netsvcs
State: Stopped
Process ID: 0
Started: False
Exit Code: 1077
Accept Pause: False
Accept Stop: False

Service Name: Browser
Display Name: Computer Browser
Start Mode: Auto
Start Name: LocalSystem
Description: Maintains an updated list of computers on the network and supplies this list to computers …
Service Type: Share Process
Path: c:\windows\system32\svchost.exe -k netsvcs
State: Running
Process ID: 792
Started: True
Exit Code: 0
Accept Pause: False
Accept Stop: True

Service Name: ccEvtMgr
Display Name: Symantec Event Manager
Start Mode: Auto
Start Name: LocalSystem
Description: Symantec Event …
Service Type: Own Process
Path: c:\program files\common files\symantec shared\ccevtmgr.exe
State: Running
Process ID: 1772
Started: True
Exit Code: 0
Accept Pause: False
Accept Stop: True

Service Name: cisvc
Display Name: Indexing Service
Start Mode: Manual
Start Name: LocalSystem
Description: Indexes contents and properties of files on local and remote computers; provides rapid access to …
Service Type: Share Process
Path: c:\windows\system32\cisvc.exe
State: Stopped
Process ID: 0
Started: False
Exit Code: 1077
Accept Pause: False
Accept Stop: False

Service Name: ClipSrv
Display Name: ClipBook
Start Mode: Disabled
Start Name: LocalSystem
Description: Enables ClipBook Viewer to store information and share it with remote computers. If the service is …
Service Type: Own Process
Path: c:\windows\system32\clipsrv.exe
State: Stopped
Process ID: 0
Started: False
Exit Code: 1077
Accept Pause: False
Accept Stop: False

Service Name: COMSysApp
Display Name: COM+ System Application
Start Mode: Manual
Start Name: LocalSystem
Description: Manages the configuration and tracking of Component Object Model (COM)+-based components. If the …
Service Type: Own Process
Path: c:\windows\system32\dllhost.exe /processid:{02d4b3f1-fd88-11d1-960d-00805fc79235}
State: Stopped
Process ID: 0
Started: False
Exit Code: 1077
Accept Pause: False
Accept Stop: False

Service Name: Creative Service for CDROM Access
Display Name: Creative Service for CDROM Access
Start Mode: Auto
Start Name: LocalSystem
Description: …
Service Type: Own Process
Path: c:\windows\system32\ctsvccda.exe
State: Running
Process ID: 1808
Started: True
Exit Code: 0
Accept Pause: False
Accept Stop: True

Service Name: CryptSvc
Display Name: Cryptographic Services
Start Mode: Auto
Start Name: LocalSystem
Description: Provides three management services: Catalog Database Service, which confirms the signatures of …
Service Type: Share Process
Path: c:\windows\system32\svchost.exe -k netsvcs
State: Running
Process ID: 792
Started: True
Exit Code: 0
Accept Pause: False
Accept Stop: True

Service Name: DcomLaunch
Display Name: DCOM Server Process Launcher
Start Mode: Auto
Start Name: LocalSystem
Description: Provides launch functionality for DCOM …
Service Type: Share Process
Path: c:\windows\system32\svchost -k dcomlaunch
State: Running
Process ID: 684
Started: True
Exit Code: 0
Accept Pause: False
Accept Stop: False

Service Name: Dhcp
Display Name: DHCP Client
Start Mode: Auto
Start Name: LocalSystem
Description: Manages network configuration by registering and updating IP addresses and DNS …
Service Type: Share Process
Path: c:\windows\system32\svchost.exe -k netsvcs
State: Running
Process ID: 792
Started: True
Exit Code: 0
Accept Pause: False
Accept Stop: True

Service Name: dmadmin
Display Name: Logical Disk Manager Administrative Service
Start Mode: Manual
Start Name: LocalSystem
Description: Configures hard disk drives and volumes. The service only runs for configuration processes and …
Service Type: Share Process
Path: c:\windows\system32\dmadmin.exe /com
State: Stopped
Process ID: 0
Started: False
Exit Code: 1077
Accept Pause: False
Accept Stop: False

Service Name: dmserver
Display Name: Logical Disk Manager
Start Mode: Manual
Start Name: LocalSystem
Description: Detects and monitors new hard disk drives and sends disk volume information to Logical Disk …
Service Type: Share Process
Path: c:\windows\system32\svchost.exe -k netsvcs
State: Stopped
Process ID: 0
Started: False
Exit Code: 1077
Accept Pause: False
Accept Stop: False

Service Name: Dnscache
Display Name: DNS Client
Start Mode: Auto
Start Name: NT AUTHORITY\NetworkService
Description: Resolves and caches Domain Name System (DNS) names for this computer. If this service is stopped, …
Service Type: Share Process
Path: c:\windows\system32\svchost.exe -k networkservice
State: Running
Process ID: 840
Started: True
Exit Code: 0
Accept Pause: False
Accept Stop: True

Service Name: ERSvc
Display Name: Error Reporting Service
Start Mode: Auto
Start Name: LocalSystem
Description: Allows error reporting for services and applictions running in non-standard …
Service Type: Share Process
Path: c:\windows\system32\svchost.exe -k netsvcs
State: Running
Process ID: 792
Started: True
Exit Code: 0
Accept Pause: False
Accept Stop: True

Service Name: Eventlog
Display Name: Event Log
Start Mode: Auto
Start Name: LocalSystem
Description: Enables event log messages issued by Windows-based programs and components to be viewed in Event …
Service Type: Share Process
Path: c:\windows\system32\services.exe
State: Running
Process ID: 524
Started: True
Exit Code: 0
Accept Pause: False
Accept Stop: False

Service Name: EventSystem
Display Name: COM+ Event System
Start Mode: Manual
Start Name: LocalSystem
Description: Supports System Event Notification Service (SENS), which provides automatic distribution of events …
Service Type: Share Process
Path: c:\windows\system32\svchost.exe -k netsvcs
State: Running
Process ID: 792
Started: True
Exit Code: 0
Accept Pause: False
Accept Stop: True

Service Name: FastUserSwitchingCompatibility
Display Name: Fast User Switching Compatibility
Start Mode: Manual
Start Name: LocalSystem
Description: Provides management for applications that require assistance in a multiple user …
Service Type: Share Process
Path: c:\windows\system32\svchost.exe -k netsvcs
State: Running
Process ID: 792
Started: True
Exit Code: 0
Accept Pause: False
Accept Stop: True

Service Name: helpsvc
Display Name: Help and Support
Start Mode: Auto
Start Name: LocalSystem
Description: Enables Help and Support Center to run on this computer. If this service is stopped, Help and …
Service Type: Share Process
Path: c:\windows\system32\svchost.exe -k netsvcs
State: Running
Process ID: 792
Started: True
Exit Code: 0
Accept Pause: False
Accept Stop: True

Service Name: HidServ
Display Name: Human Interface Device Access
Start Mode: Disabled
Start Name: LocalSystem
Description: Enables generic input access to Human Interface Devices (HID), which activates and maintains the …
Service Type: Share Process
Path: c:\windows\system32\svchost.exe -k netsvcs
State: Stopped
Process ID: 0
Started: False
Exit Code: 1077
Accept Pause: False
Accept Stop: False

Service Name: HTTPFilter
Display Name: HTTP SSL
Start Mode: Manual
Start Name: LocalSystem
Description: This service implements the secure hypertext transfer protocol (HTTPS) for the HTTP service, …
Service Type: Share Process
Path: c:\windows\system32\svchost.exe -k httpfilter
State: Stopped
Process ID: 0
Started: False
Exit Code: 1077
Accept Pause: False
Accept Stop: False

Service Name: ImapiService
Display Name: IMAPI CD-Burning COM Service
Start Mode: Manual
Start Name: LocalSystem
Description: Manages CD recording using Image Mastering Applications Programming Interface (IMAPI). If this …
Service Type: Own Process
Path: c:\windows\system32\imapi.exe
State: Stopped
Process ID: 0
Started: False
Exit Code: 1077
Accept Pause: False
Accept Stop: False

Service Name: lanmanserver
Display Name: Server
Start Mode: Auto
Start Name: LocalSystem
Description: Supports file, print, and named-pipe sharing over the network for this computer. If this service …
Service Type: Share Process
Path: c:\windows\system32\svchost.exe -k netsvcs
State: Running
Process ID: 792
Started: True
Exit Code: 0
Accept Pause: True
Accept Stop: True

Service Name: lanmanworkstation
Display Name: Workstation
Start Mode: Auto
Start Name: LocalSystem
Description: Creates and maintains client network connections to remote servers. If this service is stopped, …
Service Type: Share Process
Path: c:\windows\system32\svchost.exe -k netsvcs
State: Running
Process ID: 792
Started: True
Exit Code: 0
Accept Pause: True
Accept Stop: True

Service Name: LexBceS
Display Name: LexBce Server
Start Mode: Auto
Start Name: LocalSystem
Description: …
Service Type: Own Process
Path: c:\windows\system32\lexbces.exe
State: Running
Process ID: 1108
Started: True
Exit Code: 0
Accept Pause: False
Accept Stop: True

Service Name: LmHosts
Display Name: TCP/IP NetBIOS Helper
Start Mode: Auto
Start Name: NT AUTHORITY\LocalService
Description: Enables support for NetBIOS over TCP/IP (NetBT) service and NetBIOS name …
Service Type: Share Process
Path: c:\windows\system32\svchost.exe -k localservice
State: Running
Process ID: 876
Started: True
Exit Code: 0
Accept Pause: False
Accept Stop: True

Service Name: Messenger
Display Name: Messenger
Start Mode: Disabled
Start Name: LocalSystem
Description: Transmits net send and Alerter service messages between clients and servers. This service is not …
Service Type: Share Process
Path: c:\windows\system32\svchost.exe -k netsvcs

MrC,

Did all that you said. Had trouble the first time and had to go back and do again. Seems o.k. now. The only problem I keep having, and began when the virus attacked, is an occasional crash. The screen will spike and then system reboots. From what I have been reading through all of this ordeal is that a virus could be causing this. I hope it is not my power supply going. Also, would you know how I could restore my original pop-blocker back? My toolbar is rearranged now and I lost my little on/off switch in the bar for the blocker. All said, things are feeling better. Here is a fresh HJT log. Let's see if I am almost through this.






Logfile of HijackThis v1.99.0
Scan saved at 2:30:50 PM, on 2/3/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\WINDOWS\System32\qttask.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\Creative\ShareDLL\CtNotify.exe
C:\PROGRA~1\TEXTBR~1.0\Bin\INSTAN~1.EXE
C:\Program Files\Windows AdStatus\WinStat.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Windows AdStatus\WinStatKeep.exe
C:\PROGRA~1\PANICW~1\POP-UP~2\PSFree.exe
C:\Program Files\Creative\ShareDLL\MediaDet.Exe
C:\Program Files\ePlus48U\ScanPanel\ScnPanel.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\PROGRA~1\NORTON~2\SPEEDD~1\nopdb.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Tim S\My Documents\hijack.exe\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Optimum Online
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [POINTER] C:\Program Files\Microsoft Hardware\Mouse\point32.exe
O4 - HKLM\..\Run: [QuickTime Task] C:\WINDOWS\System32\qttask.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [Disc Detector] C:\Program Files\Creative\ShareDLL\CtNotify.exe
O4 - HKLM\..\Run: [RegisterDropHandler] C:\PROGRA~1\TEXTBR~1.0\Bin\REGIST~1.EXE
O4 - HKLM\..\Run: [InstantAccess] C:\PROGRA~1\TEXTBR~1.0\Bin\INSTAN~1.EXE /h
O4 - HKLM\..\Run: [Windows AdStatus] C:\Program Files\Windows AdStatus\WinStat.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\RunServices: [RegisterDropHandler] C:\PROGRA~1\TEXTBR~1.0\Bin\REGIST~1.EXE
O4 - HKLM\..\RunOnce: [DELDIR0.EXE] "C:\DOCUME~1\TIMS~1\LOCALS~1\Temp\DELDIR0.EXE" "C:\Program Files\McAfee\McAfee Shared Components\Central"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe"
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~2\PSFree.exe"
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: ScanPanel.lnk = C:\Program Files\ePlus48U\ScanPanel\ScnPanel.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.optonline.net
O15 - Trusted Zone: *.frame.crazywinnings.com
O15 - Trusted Zone: *.frame.crazywinnings.com (HKLM)
O15 - Trusted IP range: 206.161.125.149
O15 - Trusted IP range: (HKLM)
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O23 - Service: Symantec Event Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: LexBce Server - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Norton AntiVirus Auto Protect Service - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Unerase Protection - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
O23 - Service: ScriptBlocking Service - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~2\SPEEDD~1\nopdb.exe
O23 - Service: SymWMI Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

O.K.,

Killbox did it. It found and deleted WinStat but couldn't find WinStatKeep. After the procedure I deleted the folders as instructed. I did a search on the C: Drive for any other WinStat items. The only ones I found were in the Norton Recycled Bin. I emptied the contents before leaving Safe Mode. I rebooted and went forward with the instructions from your previous post. I fixed "04" or the WinStat line in HJT. I also deleted the two remaining "15"'s or .frame.crazywinnings.com. The 15's keep coming back when I run a new HJT scan. The delete instructions won't take for them. The task manager does not show WinStat anymore.

Here is the current log…


Logfile of HijackThis v1.99.0
Scan saved at 10:01:34 PM, on 2/4/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\WINDOWS\System32\qttask.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\Creative\ShareDLL\CtNotify.exe
C:\PROGRA~1\TEXTBR~1.0\Bin\INSTAN~1.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\PANICW~1\POP-UP~2\PSFree.exe
C:\Program Files\ePlus48U\ScanPanel\ScnPanel.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\Program Files\Creative\ShareDLL\MediaDet.Exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\PROGRA~1\NORTON~2\SPEEDD~1\nopdb.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Tim S\My Documents\hijack.exe\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Optimum Online
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [POINTER] C:\Program Files\Microsoft Hardware\Mouse\point32.exe
O4 - HKLM\..\Run: [QuickTime Task] C:\WINDOWS\System32\qttask.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [Disc Detector] C:\Program Files\Creative\ShareDLL\CtNotify.exe
O4 - HKLM\..\Run: [RegisterDropHandler] C:\PROGRA~1\TEXTBR~1.0\Bin\REGIST~1.EXE
O4 - HKLM\..\Run: [InstantAccess] C:\PROGRA~1\TEXTBR~1.0\Bin\INSTAN~1.EXE /h
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\RunServices: [RegisterDropHandler] C:\PROGRA~1\TEXTBR~1.0\Bin\REGIST~1.EXE
O4 - HKLM\..\RunOnce: [DELDIR0.EXE] "C:\DOCUME~1\TIMS~1\LOCALS~1\Temp\DELDIR0.EXE" "C:\Program Files\McAfee\McAfee Shared Components\Central"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe"
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~2\PSFree.exe"
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: ScanPanel.lnk = C:\Program Files\ePlus48U\ScanPanel\ScnPanel.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.optonline.net
O15 - Trusted Zone: *.frame.crazywinnings.com
O15 - Trusted Zone: *.frame.crazywinnings.com (HKLM)
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O23 - Service: Symantec Event Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: LexBce Server - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Norton AntiVirus Auto Protect Service - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Unerase Protection - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
O23 - Service: ScriptBlocking Service - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~2\SPEEDD~1\nopdb.exe
O23 - Service: SymWMI Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe