What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Desktop Hijack Infection

6 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hi..I am helping a friend who seems to me to have a very infested computer. This is my first time working with this. The main reason she asked for help is she seems to have a desktop hijack, where her desktop is actually a html file that is "file"//C:|WINDOWS\Web|desktop.html. She also has a yellow triangle in the task bar that leads to a website for spyware removal programs (isn't that a hoot!). She had no Windows updates in place so I was going to download and install service pack 2 but thought i would wait to make sure there aren't more problems.Here is a Hijack Log (after I enabled everything in her msconfig file).
Thanks so much for your help
jmcqueen <_<

Logfile of HijackThis v1.99.1
Scan saved at 2:06:12 PM, on 3/17/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Iomega\System32\ActivityDisk.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPClient.exe
C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe
C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Yahoo!\browser\ybrwicon.exe
C:\WINDOWS\System32\Smtray.exe
C:\Program Files\Iomega\DriveIcons\ImgIcon.exe
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Compaq\Easy Access Button Support\StartEAK.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Compaq\Easy Access Button Support\CPQEADM.EXE
C:\Program Files\Iomega\AutoDisk\AD2KClient.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\COMPAQ\CPQINET\CPQInet.exe
C:\Compaq\EAKDRV\EAUSBKBD.EXE
C:\Program Files\FinePixViewer\QuickDCF.exe
C:\PROGRA~1\Compaq\EASYAC~1\BttnServ.exe
C:\Program Files\SBC Self Support Tool\bin\mpbtn.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\SoftwareDistribution\Download\S-1-5-18\8b5e9cdb91dddbb342695fbdc36fe0e4\update\update.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\Julie Huber\My Documents\Hijack this\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dsl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://yahoo.sbc.com/dsl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/…/search/ie.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dsl
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = -
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Common\ycomp5_1_6_0.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: Cls - {CF021F40-3E14-23A5-CBA2-7173706D1316} - C:\WINDOWS\System32\spm1316.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Common\ycomp5_1_6_0.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [IPInSightLAN 02] "C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPClient.exe" -l
O4 - HKLM\..\Run: [IPInSightMonitor 02] "C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe"
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [YBrowser] C:\Program Files\Yahoo!\browser\ybrwicon.exe
O4 - HKLM\..\Run: [www.hidro.4t.com ] enbiei.exe
O4 - HKLM\..\Run: [Windows AdControl] C:\Program Files\Windows AdControl\WinAdCtl.exe
O4 - HKLM\..\Run: [WCOLOREAL] "C:\Program Files\COMPAQ\Coloreal\coloreal.exe"
O4 - HKLM\..\Run: [Task Help] wualcts.exe
O4 - HKLM\..\Run: [start uploading] smsss.exe
O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
O4 - HKLM\..\Run: [Smapp] Smtray.exe
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [RecoverFromReboot] C:\WINDOWS\Temp\RecoverFromReboot.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [MicrosoftUpdate] syshelper.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [lssas Monitoring Startup] lssas.exe
O4 - HKLM\..\Run: [lsasss.exe] C:\WINDOWS\lsasss.exe
O4 - HKLM\..\Run: [kalvsys] C:\windows\system32\kalvezw32.exe
O4 - HKLM\..\Run: [Iomega Startup Options] C:\Program Files\Iomega\Common\ImgStart.exe
O4 - HKLM\..\Run: [Iomega Drive Icons] C:\Program Files\Iomega\DriveIcons\ImgIcon.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [Cryptographic Service] C:\WINDOWS\System32\fsmrxcf.exe
O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\Compaq\Easy Access Button Support\StartEAK.exe
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\RunOnce: [Local runole service] C:\WINDOWS\System32\srvc32.exe
O4 - HKLM\..\RunOnce: [Srv32 spool service] C:\WINDOWS\System32\spoolsrv32.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] 1
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MoneyStartUp] c:\Program Files\Microsoft Money\System\Money Startup.exe
O4 - HKCU\..\Run: [Microsoft 16Bit Update] wuapdate16.exe
O4 - HKCU\..\Run: [Iomega Active Disk] C:\Program Files\Iomega\AutoDisk\AD2KClient.exe
O4 - HKCU\..\RunOnce: [Srv32 spool service] C:\WINDOWS\System32\spoolsrv32.exe
O4 - HKCU\..\RunOnce: [Local runole service] C:\WINDOWS\System32\srvc32.exe
O4 - Global Startup: Exif Launcher.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: SBC Self Support Tool.lnk = C:\Program Files\SBC Self Support Tool\bin\matcli.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O9 - Extra button: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll
O9 - Extra 'Tools' menuitem: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Support - {98BED323-CBFE-4BE4-BBA3-202BB88A9C04} - C:\Program Files\Internet Explorer\SIGNUP\Presario.htm (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://store.presario.net/scripts/redirectors/presario/storeredir2.dll?s=consumerfav&c=3c01&lc=0409
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid;=0x409
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - http://files.member.yahoo.com/dl/installs/sbc/yinst.cab
O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://download.zonelabs.com/bin/promotion…ctor/WebAAS.cab
O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} (PhotosCtrl Class) - http://photos.yahoo.com/ocx/us/yexplorer1_9us.cab
O16 - DPF: {FFFFFFFF-CACE-BABE-BABE-00AA0055595A} - http://www.trueswitch.com/TrueInstall.exe
O20 - Winlogon Notify: PCANotify - C:\WINDOWS\SYSTEM32\PCANotify.dll
O23 - Service: pcAnywhere Host Service (awhost32) - Symantec Corporation - C:\Program Files\Symantec\pcAnywhere\awhost32.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Iomega Activity Disk2 - Iomega Corporation - C:\PROGRA~1\Iomega\System32\ActivityDisk.exe
O23 - Service: IomegaAccess - Iomega Corporation - C:\WINDOWS\System32\iomegaaccess.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
Post #2
Hello jmcqueen and welcome to TomCoyote. :wavey:

That computer is infected with numerous worms and trojans caused by lack of updates.


1. Download Stinger and save it to your desktop.
2. Reboot into safe mode (tap F8 during bootup, use arrow keys to select Safe Mode, then hit 'enter').
3. Double-click on the stinger.exe file and open the tool.
4. Choose your entire hard drive to scan.
5. Choose Scan Now.
6. Stinger will fix anything that it finds.
7. Click the File menu and select Save report to file.
8. Post the log file results here in this thread.


Run at least two of the following online virus scans making sure to reboot in between each one. Allow them to fix anything they find.
You need to use Internet Explorer or Netscape browsers.
Bitdefender
Pandasoftware
Trend Micro << Click Auto Clean
Symantec Security Check << click scan for viruses
RAV Online Virus Scanner << Enter your e-mail address and click on To continue without subscribing
McAfee

Write down anything that can not be fixed. Include the file name and the path to the file.


Scan with HijackThis and post the new log as a reply to this thread. Include anything that can not be fixed by the online scans.
Post #3
Thanks Alan…we appreciate your help a great deal!
I ran Stinger…here is log file

McAfee AVERT Stinger Version 2.5.3 built on Mar 1 2005
Copyright © 2005 Networks Associates Technology, Inc. All Rights Reserved.
Virus data file v1000 created on Mar 1 2005.
Ready to scan for 53 viruses, trojans and variants.
Scan initiated on Thu Mar 24 13:32:27 2005

Number of clean files: 139195


I then ran three online scans: RAV online, Bitdefender and Trend Micro. There were a few fixed notifications and one that could not be fixed..

Troj Dialer.AM Can not access C:\windows\sasetup.dll

When I tried to delete, I get a message that the file is in use and can not be deleted.
She also has a new program that keeps popping up now that she does not know where it came from called Security IGuard. It does have an uninstall feature but I have not used it yet as I am not sure what this program is.

Here is new HijackThis log. Thanks so much again for your help!
Judi

Logfile of HijackThis v1.99.1
Scan saved at 5:15:36 PM, on 3/24/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPClient.exe
C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe
C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Yahoo!\browser\ybrwicon.exe
C:\WINDOWS\System32\Smtray.exe
C:\Program Files\Iomega\DriveIcons\ImgIcon.exe
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Compaq\Easy Access Button Support\StartEAK.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Iomega\AutoDisk\AD2KClient.exe
C:\Program Files\FinePixViewer\QuickDCF.exe
C:\Program Files\Compaq\Easy Access Button Support\CPQEADM.EXE
C:\COMPAQ\CPQINET\CPQInet.exe
C:\Compaq\EAKDRV\EAUSBKBD.EXE
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\Program Files\SBC Self Support Tool\bin\mpbtn.exe
C:\PROGRA~1\Iomega\System32\ActivityDisk.exe
C:\PROGRA~1\Compaq\EASYAC~1\BttnServ.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\Julie Huber\Desktop\Hijack this\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dsl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://yahoo.sbc.com/dsl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dsl
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = -
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Common\ycomp5_1_6_0.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: Cls - {CF021F40-3E14-23A5-CBA2-7173706D1316} - C:\WINDOWS\System32\spm1316.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Common\ycomp5_1_6_0.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [IPInSightLAN 02] "C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPClient.exe" -l
O4 - HKLM\..\Run: [IPInSightMonitor 02] "C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe"
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [YBrowser] C:\Program Files\Yahoo!\browser\ybrwicon.exe
O4 - HKLM\..\Run: [WCOLOREAL] "C:\Program Files\COMPAQ\Coloreal\coloreal.exe"
O4 - HKLM\..\Run: [Task Help] wualcts.exe
O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
O4 - HKLM\..\Run: [Smapp] Smtray.exe
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [RecoverFromReboot] C:\WINDOWS\Temp\RecoverFromReboot.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [MicrosoftUpdate] syshelper.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [Iomega Startup Options] C:\Program Files\Iomega\Common\ImgStart.exe
O4 - HKLM\..\Run: [Iomega Drive Icons] C:\Program Files\Iomega\DriveIcons\ImgIcon.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\Compaq\Easy Access Button Support\StartEAK.exe
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [Security iGuard] C:\Program Files\Security iGuard\Security iGuard.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] 1
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MoneyStartUp] c:\Program Files\Microsoft Money\System\Money Startup.exe
O4 - HKCU\..\Run: [Iomega Active Disk] C:\Program Files\Iomega\AutoDisk\AD2KClient.exe
O4 - Global Startup: Exif Launcher.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: SBC Self Support Tool.lnk = C:\Program Files\SBC Self Support Tool\bin\matcli.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O9 - Extra button: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll
O9 - Extra 'Tools' menuitem: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Microsoft AntiSpyware helper - {213A1DED-F560-43CE-900D-C2A416F1E88D} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {213A1DED-F560-43CE-900D-C2A416F1E88D} - (no file) (HKCU)
O9 - Extra button: Support - {98BED323-CBFE-4BE4-BBA3-202BB88A9C04} - C:\Program Files\Internet Explorer\SIGNUP\Presario.htm (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {D7AE115F-C75B-401A-9B4D-4C1B9C12DC27} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {D7AE115F-C75B-401A-9B4D-4C1B9C12DC27} - (no file) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://store.presario.net/scripts/redirectors/presario/storeredir2.dll?s=consumerfav&c=3c01&lc=0409
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - http://files.member.yahoo.com/dl/installs/sbc/yinst.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.com/scan8/oscan8.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://download.zonelabs.com/bin/promotion…ctor/WebAAS.cab
O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab
O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} (PhotosCtrl Class) - http://photos.yahoo.com/ocx/us/yexplorer1_9us.cab
O16 - DPF: {FFFFFFFF-CACE-BABE-BABE-00AA0055595A} - http://www.trueswitch.com/TrueInstall.exe
O20 - Winlogon Notify: PCANotify - C:\WINDOWS\SYSTEM32\PCANotify.dll
O23 - Service: pcAnywhere Host Service (awhost32) - Symantec Corporation - C:\Program Files\Symantec\pcAnywhere\awhost32.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Iomega Activity Disk2 - Iomega Corporation - C:\PROGRA~1\Iomega\System32\ActivityDisk.exe
O23 - Service: IomegaAccess - Iomega Corporation - C:\WINDOWS\System32\iomegaaccess.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
Post #4
That log looks much better. Most of the bad items were removed by the scans. :thumbup:

I added the Security iGuard in the fix with a link so you can read about it.

Step 1
Open Task Manager (ctrl+alt+delete) and end process on the following:

gcasDtServ.exe
gcasServ.exe


Step 2
Open HijackThis, run a scan, then check the following:

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = -
O2 - BHO: Cls - {CF021F40-3E14-23A5-CBA2-7173706D1316} - C:\WINDOWS\System32\spm1316.dll (file missing)

O4 - HKLM\..\Run: [Task Help] wualcts.exe
O4 - HKLM\..\Run: [MicrosoftUpdate] syshelper.exe

O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)

Optional items to check with HijackThis for improved performance.
Installed with Verizon DSL accounts. IP Insight is a Quality of Service monitor and diagnostic tool that isn't required - see here for more information. This one constantly "phones home" and wastes resource.
O4 - HKLM\..\Run: [IPInSightLAN 02] "C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPClient.exe" -l

Resource hog that launches common MS Office components to help speed up the launch of Office programs. Some users claim there's no difference with or without it but it isn't required either way.
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

You have Security iGuard on your computer. This is on the Rogue/Suspect antispyware list as it badgers users into purchase, reported hijacking by affiliates. You can read about it here. This is optional but I strongly recommend checking this entry than removing this program with Add/Remove Programs.
O4 - HKLM\..\Run: [Security iGuard] C:\Program Files\Security iGuard\Security iGuard.exe


With all other programs and browsers closed, click fix checked.


Step 3
Please set your computer to show all files.

* Double-click My Computer.
* Click the Tools menu, and then click Folder Options.
* Click the View tab.
* Clear "Hide file extensions for known file types."
* Under the "Hidden files" folder, select "Show hidden files and folders."
* Clear "Hide protected operating system files."
* Click Apply, and then click OK.

You will need to reverse this process when all steps are done.


Step 4
Please delete the following files:

C:\windows\sasetup.dll

You'll need to search for these files with Explorer to delete. They may be in C:\WINDOWS\system32\ or C:\WINDOWS\
(Start > Search > All files and folders > More advanced options place a check in the first three boxes)

wualcts.exe
syshelper.exe

If you have any problem deleting these files, reboot into Safe Mode (tap F8 during bootup, use arrow keys to select Safe Mode, then hit 'enter') and try again.


Step 5
Reboot normally and scan with HijackThis. Post the new log as a reply to this thread.
Please let us know of any complications you had and how the computer is behaving.
Post #5
Hi Alan..thanks for the quick response. I followed all your instructions. I could not find, no matter how I searched for them, the two files wualcts.exe and syshelper. exe. I looked and searched everywhere. I also was not able to delete C:\windows\sasetup.dll. I tried both in regular and safe mode. I get the notice "cannot delete sasetup: access is denied. Make sure the disk is not full or write protected and that the file is not in use." This was the same notice in both regular and safe mode.
I did delete the files in hijack this as you instructed and unistalled the security iguard.
Her desktop is still the blank greyish screen behind her icons and is a html file (same file name as before…"file"//C:|WINDOWS\Web|desktop.html)
The computer does seem to be running a little slower now but we have also updated her on all windows updates so maybe that is responsible as well. Here is hijack this file.
Thanks again for your help in resolving this mess.
Judi :weee:


Logfile of HijackThis v1.99.1
Scan saved at 6:13:35 PM, on 3/25/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe
C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Yahoo!\browser\ybrwicon.exe
C:\WINDOWS\system32\Smtray.exe
C:\Program Files\Iomega\DriveIcons\ImgIcon.exe
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Compaq\Easy Access Button Support\StartEAK.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Iomega\AutoDisk\AD2KClient.exe
C:\Program Files\FinePixViewer\QuickDCF.exe
C:\Program Files\Compaq\Easy Access Button Support\CPQEADM.EXE
C:\COMPAQ\CPQINET\CPQInet.exe
C:\Compaq\EAKDRV\EAUSBKBD.EXE
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\PROGRA~1\Compaq\EASYAC~1\BttnServ.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\SBC Self Support Tool\bin\mpbtn.exe
C:\PROGRA~1\Iomega\System32\ActivityDisk.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\pctspk.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Julie Huber\Desktop\Hijack this\HijackThis.exe
C:\Program Files\Messenger\msmsgs.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dsl
R1 - HKLM\Software\Microsoft\Internet Explor


er\Main,Default_Page_URL = http://yahoo.sbc.com/dsl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dsl
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Common\ycomp5_1_6_0.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Common\ycomp5_1_6_0.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [IPInSightMonitor 02] "C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe"
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [YBrowser] C:\Program Files\Yahoo!\browser\ybrwicon.exe
O4 - HKLM\..\Run: [WCOLOREAL] "C:\Program Files\COMPAQ\Coloreal\coloreal.exe"
O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
O4 - HKLM\..\Run: [Smapp] Smtray.exe
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [RecoverFromReboot] C:\WINDOWS\Temp\RecoverFromReboot.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [Iomega Startup Options] C:\Program Files\Iomega\Common\ImgStart.exe
O4 - HKLM\..\Run: [Iomega Drive Icons] C:\Program Files\Iomega\DriveIcons\ImgIcon.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\Compaq\Easy Access Button Support\StartEAK.exe
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] 1
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MoneyStartUp] c:\Program Files\Microsoft Money\System\Money Startup.exe
O4 - HKCU\..\Run: [Iomega Active Disk] C:\Program Files\Iomega\AutoDisk\AD2KClient.exe
O4 - Global Startup: Exif Launcher.lnk = ?
O4 - Global Startup: SBC Self Support Tool.lnk = C:\Program Files\SBC Self Support Tool\bin\matcli.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O9 - Extra button: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll
O9 - Extra 'Tools' menuitem: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Microsoft AntiSpyware helper - {213A1DED-F560-43CE-900D-C2A416F1E88D} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {213A1DED-F560-43CE-900D-C2A416F1E88D} - (no file) (HKCU)
O9 - Extra button: Support - {98BED323-CBFE-4BE4-BBA3-202BB88A9C04} - C:\Program Files\Internet Explorer\SIGNUP\Presario.htm (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {D7AE115F-C75B-401A-9B4D-4C1B9C12DC27} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {D7AE115F-C75B-401A-9B4D-4C1B9C12DC27} - (no file) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://store.presario.net/scripts/redirectors/presario/storeredir2.dll?s=consumerfav&c=3c01&lc=0409
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid;=0x409
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - http://files.member.yahoo.com/dl/installs/sbc/yinst.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.com/scan8/oscan8.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://download.zonelabs.com/bin/promotion…ctor/WebAAS.cab
O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab
O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} (PhotosCtrl Class) - http://photos.yahoo.com/ocx/us/yexplorer1_9us.cab
O16 - DPF: {FFFFFFFF-CACE-BABE-BABE-00AA0055595A} - http://www.trueswitch.com/TrueInstall.exe
O20 - Winlogon Notify: PCANotify - C:\WINDOWS\SYSTEM32\PCANotify.dll
O23 - Service: pcAnywhere Host Service (awhost32) - Symantec Corporation - C:\Program Files\Symantec\pcAnywhere\awhost32.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Iomega Activity Disk2 - Iomega Corporation - C:\PROGRA~1\Iomega\System32\ActivityDisk.exe
O23 - Service: IomegaAccess - Iomega Corporation - C:\WINDOWS\System32\iomegaaccess.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
Post #6
Click on this link http://www.downloads.subratam.org/KillBox.zip to download Pocket Killbox by Option^Explicit. Extract it from the zip file then double-click on Killbox.exe to run it.
In the 'Paste Full Path of File to Delete' box, copy and paste this entry:
C:\windows\sasetup.dll


Check the option for "Delete on Reboot". Click the button with the red circle with a white X in it. Click 'yes'. When asked to reboot choose 'yes'.


After the computer reboots, click Start < Control Panel < Display and on the Desktop tab click Customize Desktop. On the General tab click Restore Defaults. On the Web tab, remove all items that you did not place there.


Click here to download mwavscan. Double-click it to run it, select all local drives, scan all files, press 'scan' and when it is completed, anything found will be displayed in the lower pane. Highlight it, CTRL C and paste it in your next reply.


Scan with Hijackthis and post the new log as a reply to this thread. Include the mwavscan log.
Post #7
Hi Alan…things look better. We have her desktop back.
Here is the log from the virus scan. I can see that many of these are from quarantine from her virus checker. How do I delete these..as well as her system restore items.
I have put the latest hijack this file after the log from the mwavscan. Also, do you have suggestions on what she should be running to keep this from happening again? I have gotten her up to date on windows updates and switched her to firefox and zonealarm is now running. Any other suggestions?
Thanks
Judi



File C:\DOCUME~1\JULIEH~1\LOCALS~1\TEMPOR~1\Content.IE5\W9SZ8VCT\$file[1] infected by "Trojan-Dropper.Win32.Small.ty" Virus. Action Taken: No Action Taken.
File C:\Documents and Settings\Julie Huber\Desktop\HSFIX\HSFix.zip tagged as not-a-virus:RiskWare.Tool.Processor.20. No Action Taken.
File C:\Documents and Settings\Julie Huber\Local Settings\Temporary Internet Files\Content.IE5\W9SZ8VCT\$file[1] infected by "Trojan-Dropper.Win32.Small.ty" Virus. Action Taken: No Action Taken.
File C:\Documents and Settings\Julie Huber\My Documents\fixit worm desktop 0316005\HSFix\Process.exe tagged as not-a-virus:RiskWare.Tool.Processor.20. No Action Taken.
File C:\Documents and Settings\Julie Huber\My Documents\New Folder (3)\HSFix\Process.exe tagged as not-a-virus:RiskWare.Tool.Processor.20. No Action Taken.
File C:\Program Files\Iomega\DriveIcons\imghr.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Program Files\Iomega\System32\Win2kDrivers.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\003F621A.exe infected by "Trojan.Win32.TopAntiSpyware.i" Virus. Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\00EC09B2.exe infected by "Trojan.Win32.TopAntiSpyware.i" Virus. Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\02FE528E.exe infected by "Trojan.Win32.TopAntiSpyware.i" Virus. Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\047F27CF.exe infected by "Trojan.Win32.TopAntiSpyware.g" Virus. Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\05FC23D5 infected by "Trojan-Dropper.Win32.Small.oy" Virus. Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\0CBA7AC3.exe infected by "Trojan.Win32.TopAntiSpyware.g" Virus. Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\0E576C1E.exe infected by "Trojan.Win32.TopAntiSpyware.g" Virus. Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\0FCA6A2F infected by "Trojan-Dropper.Win32.Small.oy" Virus. Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\113A0454.exe infected by "Trojan.Win32.TopAntiSpyware.i" Virus. Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\113D2E50.exe infected by "Trojan.Win32.TopAntiSpyware.i" Virus. Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\13457937.exe infected by "Trojan.Win32.TopAntiSpyware.i" Virus. Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\177870E3.exe infected by "Trojan.Win32.TopAntiSpyware.i" Virus. Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\1D4244CC.exe infected by "Trojan.Win32.TopAntiSpyware.i" Virus. Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\1ED3328E.exe infected by "Trojan.Win32.TopAntiSpyware.g" Virus. Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\1F530DA9.exe infected by "Trojan.Win32.TopAntiSpyware.i" Virus. Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\1F5737A5.exe infected by "Trojan.Win32.TopAntiSpyware.i" Virus. Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\21887EF5.exe infected by "Trojan.Win32.TopAntiSpyware.i" Virus. Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\23D94C1B infected by "Trojan-Dropper.Win32.Small.oy" Virus. Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\25045CD6.exe infected by "Trojan.Win32.TopAntiSpyware.i" Virus. Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\250706D2.exe infected by "Trojan.Win32.TopAntiSpyware.i" Virus. Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\270B27BD.exe infected by "Trojan.Win32.TopAntiSpyware.i" Virus. Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\286D22FC.exe infected by "Trojan.Win32.TopAntiSpyware.i" Virus. Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\289450F7.exe infected by "Trojan.Win32.TopAntiSpyware.g" Virus. Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\29C20148.exe infected by "Trojan.Win32.TopAntiSpyware.i" Virus. Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\2A1D74EE.exe infected by "Trojan.Win32.TopAntiSpyware.i" Virus. Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\2C7363CB.exe infected by "Trojan.Win32.TopAntiSpyware.i" Virus. Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\2EB961AA.exe infected by "Trojan.Win32.TopAntiSpyware.i" Virus. Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\300E3FF6.exe infected by "Trojan.Win32.TopAntiSpyware.i" Virus. Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\310C1D4E.exe infected by "Trojan.Win32.TopAntiSpyware.i" Virus. Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\31B7611C.exe infected by "Trojan.Win32.TopAntiSpyware.i" Virus. Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\3275133B.exe infected by "Trojan.Win32.TopAntiSpyware.g" Virus. Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\32BE2279.exe infected by "Trojan.Win32.TopAntiSpyware.i" Virus. Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\32EA118C.exe infected by "Trojan.Win32.TopAntiSpyware.i" Virus. Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\33EB3B48 infected by "Trojan-Dropper.Win32.Small.oy" Virus. Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\35052058.exe infected by "Trojan.Win32.TopAntiSpyware.i" Virus. Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\354E2D7B.exe infected by "Trojan.Win32.TopAntiSpyware.i" Virus. Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\35515778.exe infected by "Trojan.Win32.TopAntiSpyware.i" Virus. Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\3868015F.exe infected by "Trojan.Win32.TopAntiSpyware.i" Virus. Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\38C7615F.exe infected by "Trojan.Win32.TopAntiSpyware.i" Virus. Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\396F42BD.exe infected by "Trojan.Win32.TopAntiSpyware.i" Virus. Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\3AB06630.exe infected by "Trojan.Win32.TopAntiSpyware.g" Virus. Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\3AD5003F.exe infected by "Trojan.Win32.TopAntiSpyware.i" Virus. Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\3B8C1A0B.exe infected by "Trojan.Win32.TopAntiSpyware.i" Virus. Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\3C4D578B.exe infected by "Trojan.Win32.TopAntiSpyware.g" Virus. Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\3D9B5C09.dll infected by "Trojan.Win32.TopAntiSpyware.i" Virus. Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\3D9E0605.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\42305265 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\458B562F.exe infected by "Trojan.Win32.TopAntiSpyware.i" Virus. Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\49155C01.exe infected by "Trojan.Win32.TopAntiSpyware.i" Virus. Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\4B042AC8.exe infected by "Trojan.Win32.TopAntiSpyware.g" Virus. Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\4B2050E5.exe infected by "Trojan.Win32.TopAntiSpyware.i" Virus. Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\4B237AE1.exe infected by "Trojan.Win32.TopAntiSpyware.i" Virus. Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\4B352A94.exe infected by "Trojan.Win32.TopAntiSpyware.g" Virus. Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\4CA55022.exe infected by "Trojan.Win32.TopAntiSpyware.g" Virus. Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\4E311E16.exe infected by "Trojan.Win32.TopAntiSpyware.i" Virus. Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\55204676.exe infected by "Trojan.Win32.TopAntiSpyware.i" Virus. Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\568A3C63.exe infected by "Trojan.Win32.TopAntiSpyware.g" Virus. Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\580C0C62 infected by "Trojan-Dropper.Win32.Small.oy" Virus. Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\596256A3.exe infected by "Trojan.Win32.TopAntiSpyware.i" Virus. Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\5BFF2430.exe infected by "Trojan.Win32.TopAntiSpyware.i" Virus. Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\5C9A5322.exe infected by "Trojan.Win32.TopAntiSpyware.g" Virus. Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\5CD8608A.exe infected by "Trojan.Win32.TopAntiSpyware.i" Virus. Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\5E504463.exe infected by "Trojan.Win32.TopAntiSpyware.i" Virus. Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\5EE67F6A.exe infected by "Trojan.Win32.TopAntiSpyware.i" Virus. Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\61DA52BC infected by "Trojan-Dropper.Win32.Small.oy" Virus. Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\65A3446E.exe infected by "Trojan.Win32.TopAntiSpyware.i" Virus. Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\6D290528.exe infected by "Trojan.Win32.TopAntiSpyware.i" Virus. Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\6D2C2F25.exe infected by "Trojan.Win32.TopAntiSpyware.i" Virus. Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\6F315010.exe infected by "Trojan.Win32.TopAntiSpyware.i" Virus. Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\6F347A0C.exe infected by "Trojan.Win32.TopAntiSpyware.i" Virus. Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\709220A5.exe infected by "Trojan.Win32.TopAntiSpyware.i" Virus. Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\70D01F30.exe infected by "Trojan.Win32.TopAntiSpyware.g" Virus. Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\75880107.exe infected by "Trojan.Win32.TopAntiSpyware.i" Virus. Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\78004180.dll infected by "Trojan-Downloader.Win32.Small.aoa" Virus. Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\780B0C4B.exe infected by "Trojan.Win32.TopAntiSpyware.i" Virus. Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\79244208.exe infected by "Trojan.Win32.TopAntiSpyware.g" Virus. Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\793145A1.exe infected by "Trojan.Win32.TopAntiSpyware.i" Virus. Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\79F3236C.exe infected by "Trojan.Win32.TopAntiSpyware.i" Virus. Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\7A9E658A.exe infected by "Trojan.Win32.TopAntiSpyware.g" Virus. Action Taken: No Action Taken.
File C:\Program Files\Norton AntiVirus\Quarantine\7D777FCA.exe infected by "Trojan.Win32.TopAntiSpyware.i" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP889\A0036807.pif infected by "Trojan-Downloader.BAT.Ftp.z" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP903\A0038871.pif infected by "Trojan-Downloader.BAT.Ftp.z" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP921\A0039989.exe infected by "Backdoor.Win32.Agent.en" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP925\A0042025.exe infected by "not-a-virus:Porn-Downloader.Win32.TibSystems" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP926\A0042160.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP926\A0042253.exe infected by "Net-Worm.Win32.Sasser.d" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP926\A0042254.exe infected by "Net-Worm.Win32.Sasser.d" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP926\A0042255.exe infected by "Net-Worm.Win32.Sasser.d" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP926\A0042256.exe infected by "Net-Worm.Win32.Sasser.d" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP926\A0042257.exe infected by "Net-Worm.Win32.Sasser.d" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP926\A0042258.exe infected by "Net-Worm.Win32.Sasser.d" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP926\A0042259.exe infected by "Net-Worm.Win32.Sasser.d" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP926\A0042260.exe infected by "Net-Worm.Win32.Sasser.d" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP926\A0042261.exe infected by "Net-Worm.Win32.Sasser.d" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP926\A0042262.exe infected by "Net-Worm.Win32.Sasser.d" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP926\A0042263.exe infected by "Net-Worm.Win32.Sasser.d" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP926\A0042264.exe infected by "Net-Worm.Win32.Sasser.d" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP926\A0042265.exe infected by "Net-Worm.Win32.Sasser.d" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP926\A0042266.exe infected by "Net-Worm.Win32.Sasser.d" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP926\A0042267.exe infected by "Net-Worm.Win32.Sasser.d" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP926\A0042268.exe infected by "Net-Worm.Win32.Sasser.d" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP926\A0042269.exe infected by "Net-Worm.Win32.Sasser.d" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP926\A0042270.exe infected by "Net-Worm.Win32.Sasser.d" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP926\A0042271.exe infected by "Net-Worm.Win32.Sasser.d" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP926\A0042272.exe infected by "Net-Worm.Win32.Sasser.d" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP926\A0042273.exe infected by "Net-Worm.Win32.Sasser.d" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP926\A0042274.exe infected by "Net-Worm.Win32.Sasser.d" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP926\A0042275.exe infected by "Net-Worm.Win32.Sasser.d" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP926\A0042276.exe infected by "Net-Worm.Win32.Sasser.d" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP926\A0042277.exe infected by "Net-Worm.Win32.Sasser.d" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP926\A0042278.exe infected by "Net-Worm.Win32.Sasser.d" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP926\A0042279.exe infected by "Net-Worm.Win32.Padobot.m" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP926\A0042280.exe infected by "Net-Worm.Win32.Padobot.m" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP928\A0043350.exe infected by "Backdoor.Win32.SdBot.gen" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP928\A0043351.exe infected by "Backdoor.Win32.Rbot.fo" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP928\A0043352.exe infected by "Backdoor.Win32.Wootbot.u" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP928\A0043353.exe infected by "Backdoor.Win32.Wootbot.gen" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP934\A0043415.exe infected by "Worm.Win32.Lovesan.a" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP934\A0043416.exe infected by "not-a-virus:AdWare.WinAD.b" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP934\A0043418.exe infected by "not-a-virus:AdWare.ToolBar.EliteBar.z" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP934\A0043419.exe infected by "Trojan-Downloader.Win32.Tibser.c" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP939\A0043936.exe infected by "Trojan-Dropper.Win32.Small.uy" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP940\A0043938.exe infected by "Trojan-Dropper.Win32.Small.uy" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP941\A0043940.exe infected by "Trojan-Dropper.Win32.Small.uy" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP941\A0044928.exe infected by "Trojan-Dropper.Win32.Small.oy" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP942\A0044950.exe infected by "Trojan-Dropper.Win32.Small.oy" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP942\A0044952.exe infected by "Trojan-Dropper.Win32.Small.uy" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP943\A0044959.exe infected by "Trojan-Dropper.Win32.Small.oy" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP943\A0044965.exe infected by "Trojan-Dropper.Win32.Small.uy" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP943\A0044971.exe infected by "Trojan-Dropper.Win32.Small.oy" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP943\A0044973.exe infected by "Worm.Win32.Lovesan.a" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP944\A0044987.exe infected by "Trojan-Dropper.Win32.Small.oy" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP944\A0045252.dll infected by "Trojan-Downloader.Win32.Agent.ga" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP944\A0045253.dll infected by "Backdoor.Win32.Agent.en" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP944\A0045254.dll infected by "Backdoor.Win32.Agent.en" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP944\A0045263.exe infected by "Trojan-Dropper.Win32.Small.oy" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP945\A0045278.exe infected by "not-a-virus:AdWare.WinAD" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP945\A0045279.exe infected by "Trojan.Win32.TopAntiSpyware.h" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP945\A0045287.exe infected by "Trojan-Dropper.Win32.Small.oy" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP945\A0045288.dll infected by "Trojan.Win32.TopAntiSpyware.h" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP945\A0045299.exe infected by "Trojan-Dropper.Win32.Small.oy" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP945\A0045306.exe infected by "Trojan-Dropper.Win32.Small.oy" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP945\A0045326.exe infected by "Trojan-Dropper.Win32.Small.oy" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP947\A0045407.exe infected by "Trojan-Dropper.Win32.Small.oy" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP947\A0045408.dll infected by "Trojan.Win32.TopAntiSpyware.h" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP947\A0045416.exe infected by "Trojan-Dropper.Win32.Small.oy" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP948\A0045424.exe infected by "Trojan-Dropper.Win32.Small.oy" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP962\A0046405.exe infected by "Trojan.Win32.TopAntiSpyware.h" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP962\A0046413.exe infected by "Trojan-Dropper.Win32.Small.oy" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP962\A0046414.dll infected by "Trojan.Win32.TopAntiSpyware.h" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP962\A0048415.exe infected by "Trojan-Dropper.Win32.Small.oy" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP962\A0048416.dll infected by "Trojan.Win32.TopAntiSpyware.i" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP963\A0048434.exe infected by "Trojan-Dropper.Win32.Small.oy" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP963\A0048435.dll infected by "Trojan.Win32.TopAntiSpyware.i" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP964\A0048441.exe infected by "Trojan-Dropper.Win32.Small.oy" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP964\A0048442.dll infected by "Trojan.Win32.TopAntiSpyware.i" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP965\A0048464.dll infected by "Trojan-Downloader.Win32.Small.aoa" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP965\A0048472.exe infected by "Trojan-Downloader.Win32.Small.aoa" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP965\A0048521.exe infected by "Backdoor.Win32.Wootbot.gen" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP965\A0048522.exe infected by "Trojan-Dropper.Win32.Small.oy" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP965\A0048523.exe infected by "Trojan-Downloader.Win32.Small.aoa" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP965\A0048524.exe infected by "Net-Worm.Win32.Sasser.d" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP965\A0048525.exe infected by "Trojan-Dropper.Win32.Small.oy" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP965\A0048526.exe infected by "Net-Worm.Win32.Sasser.d" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP965\A0048527.exe infected by "Net-Worm.Win32.Sasser.d" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP965\A0048528.exe infected by "Net-Worm.Win32.Sasser.d" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP965\A0048529.dll infected by "Trojan-Downloader.Win32.Small.aoa" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP965\A0048530.exe infected by "Net-Worm.Win32.Sasser.d" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP965\A0048531.exe infected by "Trojan-Downloader.Win32.Tibser.c" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP965\A0048532.exe infected by "Net-Worm.Win32.Sasser.d" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP965\A0048533.exe infected by "Net-Worm.Win32.Sasser.d" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP965\A0048534.exe infected by "Net-Worm.Win32.Sasser.d" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP965\A0048535.exe infected by "Net-Worm.Win32.Sasser.d" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP965\A0048536.exe infected by "Net-Worm.Win32.Sasser.d" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP965\A0048537.exe infected by "Net-Worm.Win32.Sasser.d" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP965\A0048538.exe infected by "Net-Worm.Win32.Sasser.d" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP965\A0048539.exe infected by "Net-Worm.Win32.Sasser.d" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP965\A0048540.exe infected by "Net-Worm.Win32.Padobot.m" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP965\A0048541.exe infected by "Net-Worm.Win32.Padobot.m" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP965\A0048542.exe infected by "Trojan-Dropper.Win32.Small.oy" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP965\A0048543.exe infected by "Net-Worm.Win32.Sasser.d" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP965\A0048544.exe infected by "Net-Worm.Win32.Sasser.d" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP965\A0048545.exe infected by "Net-Worm.Win32.Sasser.d" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP965\A0048546.exe infected by "Net-Worm.Win32.Sasser.d" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP965\A0048547.exe infected by "Net-Worm.Win32.Sasser.d" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP965\A0048548.exe infected by "Net-Worm.Win32.Sasser.d" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP965\A0048549.exe infected by "Net-Worm.Win32.Sasser.d" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP965\A0048550.exe infected by "Net-Worm.Win32.Sasser.d" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP965\A0048551.exe infected by "Trojan-Dropper.Win32.Small.oy" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP965\A0048552.exe infected by "Net-Worm.Win32.Padobot.m" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP965\A0048553.exe infected by "Trojan-Dropper.Win32.Small.oy" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP965\A0048554.exe infected by "Net-Worm.Win32.Sasser.d" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP965\A0048555.exe infected by "Net-Worm.Win32.Sasser.d" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP965\A0048556.exe infected by "Net-Worm.Win32.Sasser.d" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP965\A0048557.exe infected by "Net-Worm.Win32.Sasser.d" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP965\A0048558.exe infected by "Net-Worm.Win32.Sasser.d" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP965\A0048559.exe infected by "Worm.Win32.Lovesan.a" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP965\A0048560.exe infected by "not-a-virus:AdWare.WinAD.b" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP965\A0048561.exe infected by "Trojan-Downloader.Win32.Tibser.c" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP965\A0048562.exe infected by "not-a-virus:AdWare.ToolBar.EliteBar.z" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP965\A0048563.exe infected by "not-a-virus:AdWare.ToolBar.EliteBar.z" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP965\A0048564.exe infected by "not-a-virus:AdWare.WinAD.b" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP965\A0048565.dll infected by "not-a-virus:AdWare.WinAD.b" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP965\A0048566.exe infected by "Backdoor.Win32.SdBot.gen" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP965\A0048567.exe infected by "Backdoor.Win32.Rbot.fo" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP965\A0048568.exe infected by "Backdoor.Win32.Wootbot.u" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP965\A0048570.dll infected by "Trojan-Downloader.Win32.Small.aoa" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP965\A0048571.dll infected by "Trojan.Win32.TopAntiSpyware.h" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP965\A0048572.dll infected by "Trojan-Downloader.Win32.Agent.kf" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP965\A0048590.exe infected by "Trojan-Dropper.Win32.Small.uy" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP965\A0048591.exe infected by "Trojan-Dropper.Win32.Small.uy" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP968\A0051865.dll infected by "Trojan.Win32.TopAntiSpyware.i" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{6F58C3A6-2690-4845-BF76-6242BD9523CE}\RP968\A0051866.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken.
File D:\CPQS\TOOLS\REBOOT.COM tagged as not-a-virus:Tool.DOS.Reboot. No Action Taken.




Logfile of HijackThis v1.99.1
Scan saved at 2:55:38 PM, on 3/26/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe
C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Yahoo!\browser\ybrwicon.exe
C:\WINDOWS\system32\Smtray.exe
C:\Program Files\Iomega\DriveIcons\ImgIcon.exe
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Compaq\Easy Access Button Support\StartEAK.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Iomega\AutoDisk\AD2KClient.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\Program Files\Compaq\Easy Access Button Support\CPQEADM.EXE
C:\COMPAQ\CPQINET\CPQInet.exe
C:\Compaq\EAKDRV\EAUSBKBD.EXE
C:\Program Files\FinePixViewer\QuickDCF.exe
C:\PROGRA~1\Compaq\EASYAC~1\BttnServ.exe
C:\Program Files\SBC Self Support Tool\bin\mpbtn.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\PROGRA~1\Iomega\System32\ActivityDisk.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\pctspk.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Julie Huber\Desktop\Hijack this\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dsl

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://yahoo.sbc.com/dsl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dsl
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Common\ycomp5_1_6_0.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Common\ycomp5_1_6_0.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [IPInSightMonitor 02] "C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe"
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [YBrowser] C:\Program Files\Yahoo!\browser\ybrwicon.exe
O4 - HKLM\..\Run: [WCOLOREAL] "C:\Program Files\COMPAQ\Coloreal\coloreal.exe"
O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
O4 - HKLM\..\Run: [Smapp] Smtray.exe
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [Iomega Startup Options] C:\Program Files\Iomega\Common\ImgStart.exe
O4 - HKLM\..\Run: [Iomega Drive Icons] C:\Program Files\Iomega\DriveIcons\ImgIcon.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\Compaq\Easy Access Button Support\StartEAK.exe
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Iomega Active Disk] C:\Program Files\Iomega\AutoDisk\AD2KClient.exe
O4 - Global Startup: Exif Launcher.lnk = ?
O4 - Global Startup: SBC Self Support Tool.lnk = C:\Program Files\SBC Self Support Tool\bin\matcli.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O9 - Extra button: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll
O9 - Extra 'Tools' menuitem: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Microsoft AntiSpyware helper - {213A1DED-F560-43CE-900D-C2A416F1E88D} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {213A1DED-F560-43CE-900D-C2A416F1E88D} - (no file) (HKCU)
O9 - Extra button: Support - {98BED323-CBFE-4BE4-BBA3-202BB88A9C04} - C:\Program Files\Internet Explorer\SIGNUP\Presario.htm (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {D7AE115F-C75B-401A-9B4D-4C1B9C12DC27} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {D7AE115F-C75B-401A-9B4D-4C1B9C12DC27} - (no file) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://store.presario.net/scripts/redirectors/presario/storeredir2.dll?s=consumerfav&c=3c01&lc=0409
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid;=0x409
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - http://files.member.yahoo.com/dl/installs/sbc/yinst.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.com/scan8/oscan8.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://download.zonelabs.com/bin/promotion…ctor/WebAAS.cab
O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab
O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} (PhotosCtrl Class) - http://photos.yahoo.com/ocx/us/yexplorer1_9us.cab
O16 - DPF: {FFFFFFFF-CACE-BABE-BABE-00AA0055595A} - http://www.trueswitch.com/TrueInstall.exe
O20 - Winlogon Notify: PCANotify - C:\WINDOWS\SYSTEM32\PCANotify.dll
O23 - Service: pcAnywhere Host Service (awhost32) - Symantec Corporation - C:\Program Files\Symantec\pcAnywhere\awhost32.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Iomega Activity Disk2 - Iomega Corporation - C:\PROGRA~1\Iomega\System32\ActivityDisk.exe
O23 - Service: IomegaAccess - Iomega Corporation - C:\WINDOWS\System32\iomegaaccess.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
Post #8
If all is well after this fix, I'll give you some recommended programs to help keep the computer clean.:)

Step 1
Open HijackThis, run a scan, then check the following:

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com

With all other programs and browsers closed, click fix checked.


Step 2
Please delete your temporary files by deleting all files and folders that are in those folders (do not delete the temp folder itself) like for example
C:\WINDOWS\Temp\
C:\Temp\
C:\Documents and Settings\Every username\Local Settings\Temp\
Also delete your Temporary Internet Files (Start > Control Panel > Internet Options > Delete Files), be sure to also select delete all offline content.
Empty the Recycle Bin.


Step 3
Open Norton Antivirus and click reports. In quarantined items click "view report" and in the window that opens click Quarantined Items. Highlight each line in the left column and click Delete Item from the toolbar above. Repeat this procedure for the Backup Items.


Step 4
Reset and Re-enable your System Restore to remove bad files that have been backed up by Windows. The files in System Restore are protected to prevent any programs changing those files. This is the only way to clean these files: (You will lose all previous restore points which are likely to be infected.)

1. Right-click My Computer, and then click Properties.
2. On the Performance tab, click File System, or press ALT+F.
3. On the Troubleshooting tab, put a check mark in the 'Turn Off System Restore' check box.
4. Click OK twice, and then click Yes when you are prompted to restart the computer.
5. Repeat steps 1 - 3, this time clearing the box beside 'Turn Off System Restore'


Step 5
Reboot normally and scan with HijackThis. Post the new log as a reply to this thread. Include a new mwavscan log.
Please let us know of any complications you had and how the computer is behaving.
Post #9
Hi Alan..all instructions done, here is mwavscan log…

File C:\Documents and Settings\Julie Huber\Desktop\HSFIX\HSFix.zip tagged as not-a-virus:RiskWare.Tool.Processor.20. No Action Taken.
File C:\Documents and Settings\Julie Huber\My Documents\fixit worm desktop 0316005\HSFix\Process.exe tagged as not-a-virus:RiskWare.Tool.Processor.20. No Action Taken.
File C:\Documents and Settings\Julie Huber\My Documents\New Folder (3)\HSFix\Process.exe tagged as not-a-virus:RiskWare.Tool.Processor.20. No Action Taken.
File C:\Program Files\Iomega\DriveIcons\imghr.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Program Files\Iomega\System32\Win2kDrivers.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File D:\CPQS\TOOLS\REBOOT.COM tagged as not-a-virus:Tool.DOS.Reboot. No Action Taken.


and here is hijack this log…
Logfile of HijackThis v1.99.1
Scan saved at 5:11:27 PM, on 3/29/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\PROGRA~1\Iomega\System32\ActivityDisk.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\pctspk.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe
C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\WINDOWS\system32\Smtray.exe
C:\Program Files\Iomega\DriveIcons\ImgIcon.exe
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\Program Files\Iomega\AutoDisk\AD2KClient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\FinePixViewer\QuickDCF.exe
C:\Program Files\SBC Self Support Tool\bin\mpbtn.exe
C:\DOCUME~1\JULIEH~1\LOCALS~1\Temp\mwavscan.com
C:\DOCUME~1\JULIEH~1\LOCALS~1\Temp\kavss.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\Program Files\Yahoo!\browser\ybrwicon.exe
C:\Program Files\Yahoo!\Messenger\YPAGER.EXE
C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
C:\Program Files\Common Files\Microsoft Shared\Speech\sapisvr.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Julie Huber\Desktop\Hijack this\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dsl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://yahoo.sbc.com/dsl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dsl
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Common\ycomp5_1_6_0.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Common\ycomp5_1_6_0.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [IPInSightMonitor 02] "C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe"
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [WCOLOREAL] "C:\Program Files\COMPAQ\Coloreal\coloreal.exe"
O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
O4 - HKLM\..\Run: [Smapp] Smtray.exe
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [Iomega Startup Options] C:\Program Files\Iomega\Common\ImgStart.exe
O4 - HKLM\..\Run: [Iomega Drive Icons] C:\Program Files\Iomega\DriveIcons\ImgIcon.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKCU\..\Run: [Iomega Active Disk] C:\Program Files\Iomega\AutoDisk\AD2KClient.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Exif Launcher.lnk = ?
O4 - Global Startup: SBC Self Support Tool.lnk = C:\Program Files\SBC Self Support Tool\bin\matcli.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O9 - Extra button: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll
O9 - Extra 'Tools' menuitem: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Microsoft AntiSpyware helper - {213A1DED-F560-43CE-900D-C2A416F1E88D} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {213A1DED-F560-43CE-900D-C2A416F1E88D} - (no file) (HKCU)
O9 - Extra button: Support - {98BED323-CBFE-4BE4-BBA3-202BB88A9C04} - C:\Program Files\Internet Explorer\SIGNUP\Presario.htm (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {D7AE115F-C75B-401A-9B4D-4C1B9C12DC27} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {D7AE115F-C75B-401A-9B4D-4C1B9C12DC27} - (no file) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://store.presario.net/scripts/redirectors/presario/storeredir2.dll?s=consumerfav&c=3c01&lc=0409
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid;=0x409
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - http://files.member.yahoo.com/dl/installs/sbc/yinst.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.com/scan8/oscan8.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://download.zonelabs.com/bin/promotion…ctor/WebAAS.cab
O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab
O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} (PhotosCtrl Class) - http://photos.yahoo.com/ocx/us/yexplorer1_9us.cab
O16 - DPF: {FFFFFFFF-CACE-BABE-BABE-00AA0055595A} - http://www.trueswitch.com/TrueInstall.exe
O20 - Winlogon Notify: PCANotify - C:\WINDOWS\SYSTEM32\PCANotify.dll
O23 - Service: pcAnywhere Host Service (awhost32) - Symantec Corporation - C:\Program Files\Symantec\pcAnywhere\awhost32.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Iomega Activity Disk2 - Iomega Corporation - C:\PROGRA~1\Iomega\System32\ActivityDisk.exe
O23 - Service: IomegaAccess - Iomega Corporation - C:\WINDOWS\System32\iomegaaccess.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

The computer seems to shut down slowly, but otherwise everything looks good. The desktop is normal and processing speed seems good. No more pop ups.
Thanks
Judi :D
Post #10
Your new log is clean. Very nice work. :thumbup:

Now that everything is fixed, I suggest that you get these programs to help keep the computer clean:

Spyware Blaster - Blocks bad ActiveX items from installing on your computer.
SpywareGuard - Real-time protection from spyware installation attempts
ie-spyad - Puts over 8,000 bad URLs into your restricted sites for Internet Explorer.
Google Toolbar - Blocks many unwanted pop-ups in Internet Explorer.
Firefox - Safer alternative to the Internet Explorer web browser.

Here are three very good and free malware scanners:

Spybot Search and Destroy 1.3
AdAware SE v1.05
Set-up Instructions for Spybot S&D; and Adaware SE
A2 Squared

If you have them already, check to make sure that they are the newest version.

Update these regularly.

You may also want to read "How did I get infected in the first place" to learn how to better secure your computer.

Be sure to keep Windows and your Anti-virus updated.
Post #12
Your welcome. Glad the computer is working better. :)

As this topic has been resolved, the thread will be closed.

If you need this topic reopened, please request this by sending an email to us at the following link: (Click for address)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.

If this is not your thread please start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI