What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Bman, Bman1, & Others Have Invaded My Pc

23 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Hello Siggyx, Boots ok in normal mode fast and icons display ok but after that, I try to open task manager to see what's happening and nothing happens. I try other programs and it can't seem to initialize. I can hear the event 'sound' going but nothing displays on the desktop. Thanks. :huh:
Post #17
Download this tool: LQfix.zip
Unzip it to your Desktop.
Don't use it yet!

IMPORTANT! Reboot the computer into Safe Mode (tap F8 during bootup, use arrow keys to select Safe Mode, then hit 'enter').

Doubleclick LQfix.bat that you saved on your desktop before.
A doswindow will open and close again, that is normal.

Next download Trojan Hunter from the link below, it is free for 30 days. make sure that you upate before you scan. Allow it to clean what it finds and let me know if there is somehting it can not clean.

Then a new hijackthis log please.

Trojan Hunter >>>> http://www.trojanhunter.com/
Post #18
Hello Siggyx,

I installed LQfix and trojan hunter with no problem. LQFIX executed as instructed. Trojan Hunter deleted all files it found (3 on registry and several on the files). I tried rebooting normal mode but still gets hung up with just the desktop and icons showing. Clicking on Start does not do anything - still could not get to the task manager. Had to power off and reboot safe mode w/ networking to send this. I really appreciate all your help. Thank you very much… :huh:

Here's the latest Hijackthis log:

Logfile of HijackThis v1.99.1
Scan saved at 5:51:32 PM, on 4/27/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\Guest\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,(Default) = www.google.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.emachines.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\VERIZO~1\SUPPOR~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [IPInSightLAN 01] "C:\Program Files\Verizon Online\Visual IP InSight\IPClient.exe" -l
O4 - HKLM\..\Run: [IPInSightMonitor 01] "C:\Program Files\Verizon Online\Visual IP InSight\IPMon32.exe"
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
O4 - HKLM\..\Run: [RoxioAudioCentral] "C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: AcBtnMgr_X63.exe.lnk = C:\Program Files\LexmarkX63\AcBtnMgr_X63.exe
O4 - Global Startup: ACMonitor_X63.exe.lnk = C:\Program Files\LexmarkX63\ACMonitor_X63.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\BigFix.exe
O4 - Global Startup: Cisco Systems VPN Client.lnk = C:\Program Files\Cisco Systems\VPN Client\vpngui.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Verizon Online Support Center.lnk = C:\Program Files\Verizon Online\SupportCenter\bin\matcli.exe
O9 - Extra button: Control Pad - {28D44DAD-D1FC-4d4f-BB1B-ADF037C8DDBC} - C:\Program Files\Verizon Online\Verizon Online Control Pad\VerizonControlPad.Exe
O9 - Extra 'Tools' menuitem: Control Pad - {28D44DAD-D1FC-4d4f-BB1B-ADF037C8DDBC} - C:\Program Files\Verizon Online\Verizon Online Control Pad\VerizonControlPad.Exe
O9 - Extra button: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O9 - Extra button: AOL Instant Messenger (SM) - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\aim\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com
O15 - Trusted Zone: *.hotmail.com
O15 - Trusted Zone: *.masstimes.org
O15 - Trusted Zone: *.sigalert.com
O15 - Trusted Zone: *.uiuc.edu
O16 - DPF: {1E2941E3-8E63-11D4-9D5A-00902742D6E0} (iNotes Class) - https://clbchma01.ci.long-beach.ca.us/iNotes.cab
O16 - DPF: {2C15848B-21C0-406A-9902-56C8D90684F3} (alaWeb.clsGetStats) - file://C:\WIN2000\CONTENT\cabs\alaWeb.CAB
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1408.g.akamai.net/7/1408/9955/2003…iTunesSetup.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by7fd.bay7.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {5D68B82D-C79F-4FFC-83C0-8D0FC794CEF2} (alaWeb.clsGetStats) - file://C:\WIN2000\CONTENT\cabs\alaWeb.CAB
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {AED6797A-D608-11D4-89D2-00105AA3C57F} (alaGrid.TechDocSearch) - file://C:\WinBackup\WIN2000\CONTENT\cabs\alaGrid.CAB
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.apple.com.edgesuite.net/d…/ITDetector.cab
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Gear Security Service (GEARSecurity) - GEAR Software - C:\WINDOWS\System32\gearsec.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Panda Firewall Service (PAVFIRES) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Firewall\PavFires.exe
O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PavFnSvr.exe
O23 - Service: Panda Pavkre (Pavkre) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Pavkre.exe
O23 - Service: Panda PavProt (PavProt) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PavProt.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\pavsrv51.exe
O23 - Service: Panda Preventium+ Service (PREVSRV) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\prevsrv.exe
O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software Internacional - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PsImSvc.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
Post #19
Download Ewido scanner fom the link below, it is a free scanner. Update it then scan your system and let it clean what it finds.

http://www.ewido.net/en/

Then post a new log please.
Post #20
Hello Siggyx,

That one found a few more. Here's the Hijackthis log. Thanks very much.

Logfile of HijackThis v1.99.1
Scan saved at 6:01:59 AM, on 4/28/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\Guest\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,(Default) = www.google.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.emachines.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\VERIZO~1\SUPPOR~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [IPInSightLAN 01] "C:\Program Files\Verizon Online\Visual IP InSight\IPClient.exe" -l
O4 - HKLM\..\Run: [IPInSightMonitor 01] "C:\Program Files\Verizon Online\Visual IP InSight\IPMon32.exe"
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
O4 - HKLM\..\Run: [RoxioAudioCentral] "C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: AcBtnMgr_X63.exe.lnk = C:\Program Files\LexmarkX63\AcBtnMgr_X63.exe
O4 - Global Startup: ACMonitor_X63.exe.lnk = C:\Program Files\LexmarkX63\ACMonitor_X63.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\BigFix.exe
O4 - Global Startup: Cisco Systems VPN Client.lnk = C:\Program Files\Cisco Systems\VPN Client\vpngui.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Verizon Online Support Center.lnk = C:\Program Files\Verizon Online\SupportCenter\bin\matcli.exe
O9 - Extra button: Control Pad - {28D44DAD-D1FC-4d4f-BB1B-ADF037C8DDBC} - C:\Program Files\Verizon Online\Verizon Online Control Pad\VerizonControlPad.Exe
O9 - Extra 'Tools' menuitem: Control Pad - {28D44DAD-D1FC-4d4f-BB1B-ADF037C8DDBC} - C:\Program Files\Verizon Online\Verizon Online Control Pad\VerizonControlPad.Exe
O9 - Extra button: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O9 - Extra button: AOL Instant Messenger (SM) - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\aim\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com
O15 - Trusted Zone: *.hotmail.com
O15 - Trusted Zone: *.masstimes.org
O15 - Trusted Zone: *.sigalert.com
O15 - Trusted Zone: *.uiuc.edu
O16 - DPF: {1E2941E3-8E63-11D4-9D5A-00902742D6E0} (iNotes Class) - https://clbchma01.ci.long-beach.ca.us/iNotes.cab
O16 - DPF: {2C15848B-21C0-406A-9902-56C8D90684F3} (alaWeb.clsGetStats) - file://C:\WIN2000\CONTENT\cabs\alaWeb.CAB
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1408.g.akamai.net/7/1408/9955/2003…iTunesSetup.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by7fd.bay7.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {5D68B82D-C79F-4FFC-83C0-8D0FC794CEF2} (alaWeb.clsGetStats) - file://C:\WIN2000\CONTENT\cabs\alaWeb.CAB
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {AED6797A-D608-11D4-89D2-00105AA3C57F} (alaGrid.TechDocSearch) - file://C:\WinBackup\WIN2000\CONTENT\cabs\alaGrid.CAB
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.apple.com.edgesuite.net/d…/ITDetector.cab
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: Gear Security Service (GEARSecurity) - GEAR Software - C:\WINDOWS\System32\gearsec.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Panda Firewall Service (PAVFIRES) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Firewall\PavFires.exe
O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PavFnSvr.exe
O23 - Service: Panda Pavkre (Pavkre) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Pavkre.exe
O23 - Service: Panda PavProt (PavProt) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PavProt.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\pavsrv51.exe
O23 - Service: Panda Preventium+ Service (PREVSRV) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\prevsrv.exe
O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software Internacional - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PsImSvc.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
Post #24
Hello Siggyx, Still very sloooowww when booting in normal mode. Works reasonably well with safe mode w/ networking. At least I get to respond asap. Thank you very much.
Post #26
Hello Siggyx,

Yes, I only have Panda (trial version) right now. I tried deleting Symantec awhile back but I think it did not delete all files. I started getting very slow response to system hanging on normal mode when I installed Panda. The delete of Symantec did not help.

I deleted the 016 lines. I tested in normal mode and I still have the slow response once the system boots up. I had to reboot back to safe mode with networking to get back on.

Here's my latest hijackthis log:

Logfile of HijackThis v1.99.1
Scan saved at 6:50:10 PM, on 4/30/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Verizon Online\Verizon Online Control Pad\VerizonControlPad.exe
C:\Program Files\Verizon Online\Verizon Online Control Pad\UIEngines\FlashUIEngine\cpskin.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Guest\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,(Default) = www.google.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.emachines.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\VERIZO~1\SUPPOR~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [IPInSightLAN 01] "C:\Program Files\Verizon Online\Visual IP InSight\IPClient.exe" -l
O4 - HKLM\..\Run: [IPInSightMonitor 01] "C:\Program Files\Verizon Online\Visual IP InSight\IPMon32.exe"
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
O4 - HKLM\..\Run: [RoxioAudioCentral] "C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: AcBtnMgr_X63.exe.lnk = C:\Program Files\LexmarkX63\AcBtnMgr_X63.exe
O4 - Global Startup: ACMonitor_X63.exe.lnk = C:\Program Files\LexmarkX63\ACMonitor_X63.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\BigFix.exe
O4 - Global Startup: Cisco Systems VPN Client.lnk = C:\Program Files\Cisco Systems\VPN Client\vpngui.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Verizon Online Support Center.lnk = C:\Program Files\Verizon Online\SupportCenter\bin\matcli.exe
O9 - Extra button: Control Pad - {28D44DAD-D1FC-4d4f-BB1B-ADF037C8DDBC} - C:\Program Files\Verizon Online\Verizon Online Control Pad\VerizonControlPad.Exe
O9 - Extra 'Tools' menuitem: Control Pad - {28D44DAD-D1FC-4d4f-BB1B-ADF037C8DDBC} - C:\Program Files\Verizon Online\Verizon Online Control Pad\VerizonControlPad.Exe
O9 - Extra button: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O9 - Extra button: AOL Instant Messenger (SM) - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\aim\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com
O15 - Trusted Zone: *.hotmail.com
O15 - Trusted Zone: *.masstimes.org
O15 - Trusted Zone: *.sigalert.com
O15 - Trusted Zone: *.uiuc.edu
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: Gear Security Service (GEARSecurity) - GEAR Software - C:\WINDOWS\System32\gearsec.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Panda Firewall Service (PAVFIRES) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Firewall\PavFires.exe
O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PavFnSvr.exe
O23 - Service: Panda Pavkre (Pavkre) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Pavkre.exe
O23 - Service: Panda PavProt (PavProt) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PavProt.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\pavsrv51.exe
O23 - Service: Panda Preventium+ Service (PREVSRV) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\prevsrv.exe
O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software Internacional - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PsImSvc.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

Again, Thanks very much for all your help.
Post #27
Download MicroWorld virus scan here >>> Micro World http://www.mwti.net/antivirus/free_utilities.asp

To run the virus scan make sure you click the following

memory, registry, startup folders, system folders, services, drive (all drives will be added) then click on scan clean. When the scan is complete hilight all the files in the LOWER box. Then ctrl + c and paste them into the thread ctrl + v.

I warn you the scan will take a long time to run and will not fix anything just identifies bad files.
Post #28
Hello Siggyx, This is a lot to look at. Thank you very much for your time. Here is my latest MWAV virus log info: File System Found infected by "Bargain Buddy Spyware/Adware" Virus. Action Taken: No Action Taken. File System Found infected by "BetterInternet Spyware/Adware" Virus. Action Taken: No Action Taken. File System Found infected by "mysearch Spyware/Adware" Virus. Action Taken: No Action Taken. File C:\DOCUME~1\raoul\LOCALS~1\Temp\i13.tmp infected by "not-a-virus:AdWare.SurfSide.j" Virus. Action Taken: No Action Taken. File C:\DOCUME~1\raoul\LOCALS~1\TEMPOR~1\Content.IE5\KCGQUS8U\thnall1ac[1].htm infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\marc\Local Settings\Temporary Internet Files\Content.IE5\CPA7GTE3\thnall1ac[1].htm infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\raoul\Local Settings\Temp\i13.tmp infected by "not-a-virus:AdWare.SurfSide.j" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\raoul\Local Settings\Temporary Internet Files\Content.IE5\KCGQUS8U\thnall1ac[1].htm infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\LxkX63\Scan\SETUPX63PART2.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\Program Files\LexmarkX63\RemoveX63.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\Program Files\LexmarkX63\X63Twain.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\RECYCLER\S-1-5-21-1316817595-2541319435-2214429306-1008\Dc49.exe infected by "not-a-virus:AdWare.EZula.ak" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP278\A0125866.dll infected by "not-a-virus:AdWare.ToolBar.EliteBar.af" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP278\A0125868.ax infected by "not-a-virus:AdWare.BargainBuddy.l" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP278\A0125869.vxd infected by "not-a-virus:AdWare.BargianBuddy.n" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP278\A0126845.exe infected by "not-a-virus:AdWare.ToolBar.MyWay.j" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP279\A0129914.exe infected by "not-a-virus:AdWare.SurfSide.k" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP279\A0129915.dll infected by "not-a-virus:AdWare.SurfSide.k" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP279\A0129916.dll infected by "not-a-virus:AdWare.SurfSide.k" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP279\A0129921.dll infected by "not-a-virus:AdWare.EZula.x" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP279\A0129922.exe infected by "not-a-virus:AdWare.EZula.z" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP279\A0129924.dll infected by "not-a-virus:AdWare.EZula.ab" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP279\A0129928.dll infected by "not-a-virus:AdWare.EZula.ae" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP279\A0129933.exe infected by "not-a-virus:AdWare.EZula.aw" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP279\A0129938.exe infected by "Trojan-Downloader.Win32.Dyfuca.dx" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP279\A0129939.exe infected by "not-a-virus:AdWare.WebRebates.c" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP279\A0129940.exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP279\A0129941.exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP279\A0129943.EXE infected by "not-a-virus:AdWare.VirtualBouncer.j" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP279\A0129944.EXE infected by "not-a-virus:AdWare.VirtualBouncer.j" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP279\A0129947.EXE infected by "not-a-virus:AdWare.VirtualBouncer" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP279\A0129948.exe infected by "not-a-virus:AdWare.VirtualBouncer.i" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP279\A0129949.exe infected by "not-a-virus:AdWare.VirtualBouncer.g" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP279\A0129976.exe infected by "not-a-virus:AdWare.EZula.ak" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP279\A0129977.exe infected by "not-a-virus:AdWare.EZula.ap" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP279\A0129978.dll infected by "not-a-virus:AdWare.BargainBuddy.l" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP279\A0129979.exe infected by "not-a-virus:AdWare.BargianBuddy.n" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP279\A0129982.dll infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP279\A0129983.exe infected by "not-a-virus:AdWare.CashBack.b" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP279\A0129984.exe infected by "not-a-virus:AdWare.CashBack.d" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP279\A0129985.exe infected by "not-a-virus:AdWare.BargianBuddy.n" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP279\A0129986.exe infected by "not-a-virus:AdWare.BargianBuddy.n" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP279\A0129987.exe infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP279\A0129988.srg infected by "not-a-virus:AdWare.BargianBuddy.n" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP279\A0129990.vxd infected by "not-a-virus:AdWare.BargianBuddy.n" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP279\A0130002.dll infected by "not-a-virus:AdWare.VirtualBouncer.g" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP279\A0130003.dll infected by "not-a-virus:AdWare.VirtualBouncer.g" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP279\A0130004.dll infected by "not-a-virus:AdWare.VirtualBouncer.g" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP279\A0130005.dll infected by "not-a-virus:AdWare.VirtualBouncer.g" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP283\A0132218.EXE infected by "not-a-virus:AdWare.ToolBar.MyWay.j" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP283\A0132219.DLL infected by "not-a-virus:AdWare.ToolBar.MyWay.j" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP283\A0132220.DLL infected by "not-a-virus:AdWare.ToolBar.MyWay.j" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP283\A0132231.exe infected by "Trojan-Dropper.Win32.Small.mr" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP283\A0132237.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP283\A0132238.exe infected by "not-a-virus:AdWare.WebRebates.g" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP283\A0132239.exe infected by "not-a-virus:AdWare.VirtualBouncer.c" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP283\A0132250.dll infected by "Trojan-Downloader.Win32.Qoologic.l" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP294\A0132474.exe infected by "Trojan.Win32.Stervis.b" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP294\A0132475.exe infected by "Trojan-Downloader.Win32.Agent.jq" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP294\A0132476.exe infected by "Trojan-Dropper.Win32.Delf.z" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP294\A0132477.exe infected by "Trojan-Dropper.Win32.Small.wc" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP294\A0132478.dll infected by "Trojan-Clicker.Win32.Small.et" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP294\A0132479.cpl infected by "Trojan-Dropper.Win32.Small.wc" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP294\A0132481.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP294\A0132493.dll infected by "Trojan-Clicker.Win32.Small.ez" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP295\A0153597.dll infected by "not-a-virus:AdWare.ToolBar.EliteBar.af" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP295\A0153606.exe infected by "Trojan-Downloader.Win32.Apropo.ab" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP295\A0153616.exe infected by "not-a-virus:AdWare.Wintol.ab" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP295\A0153617.ax infected by "not-a-virus:AdWare.BargainBuddy.l" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP295\A0176710.exe infected by "Trojan-Downloader.Win32.Qoologic.l" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP295\A0176711.exe infected by "Trojan-Downloader.Win32.Qoologic.l" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP295\A0176712.exe infected by "Trojan-Downloader.Win32.Qoologic.l" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP295\A0176713.dll infected by "Trojan-Downloader.Win32.Qoologic.l" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP295\A0176716.exe infected by "not-a-virus:AdWare.Searcher.h" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP295\A0176718.exe infected by "not-a-virus:AdWare.Searcher.h" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP295\A0176721.exe infected by "not-a-virus:AdWare.ToolBar.BrowserVillage.b" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP295\A0176722.dll infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP295\A0176724.dll infected by "Trojan-Clicker.Win32.Delf.r" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP295\A0176725.exe infected by "Trojan-Downloader.Win32.Adload.a" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP295\A0176726.exe infected by "not-a-virus:AdWare.WinAD.ai" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP295\A0176727.exe infected by "not-a-virus:AdWare.Sahat.o" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP295\A0176728.exe infected by "not-a-virus:AdWare.Sahat.o" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP295\A0176729.EXE infected by "not-a-virus:AdWare.SurfSide.j" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP295\A0176730.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP295\A0176731.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP295\A0176732.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP295\A0176733.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP295\A0176734.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP295\A0176735.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP295\A0176736.dll infected by "not-a-virus:AdWare.ToolBar.HotSearchBar.d" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP295\A0176742.exe infected by "Trojan-Downloader.Win32.Small.akz" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP295\A0184969.exe infected by "not-a-virus:AdWare.WinAD.ab" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP295\A0185994.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP295\A0190100.ax infected by "not-a-virus:AdWare.CashBack.b" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP295\A0190101.dll infected by "not-a-virus:AdWare.WinAD.af" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP295\A0190102.exe infected by "not-a-virus:AdWare.EZula.z" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{8871662E-88B6-4F13-8F00-94BC07FEDDD9}\RP295\A0190103.exe infected by "not-a-virus:AdWare.ToolBar.HotSearchBar.d" Virus. Action Taken: No Action Taken.
Post #29
That logs looks a lot worse than it is as most of it is sitting in your system rrestore which makes them harmless for now. We will need to reset your system restore when we are fianlly happy that your system is running well.

Download CCleaner from the link below and click on "run cleaner"

Download >>>> http://www.majorgeeks.com/download4191.html

Then boot to safe mode and run the cleaner again.

Then a new log pleae. How is it running now?
Post #30
Hello Siggyx,

Did as instructed. Tried to reboot normal mode but still gets stuck eventually after trying to select anything on the desktop. Was able to get task manager before that and I did notice that I have five (5) processes of SVCHOST.EXE. It's really not doing anything (0%) but is that normal.

Here is my Hijackthis log. Again, thanks…

Logfile of HijackThis v1.99.1
Scan saved at 10:30:16 PM, on 5/1/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\Guest\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,(Default) = www.google.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.emachines.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\VERIZO~1\SUPPOR~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [IPInSightLAN 01] "C:\Program Files\Verizon Online\Visual IP InSight\IPClient.exe" -l
O4 - HKLM\..\Run: [IPInSightMonitor 01] "C:\Program Files\Verizon Online\Visual IP InSight\IPMon32.exe"
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
O4 - HKLM\..\Run: [RoxioAudioCentral] "C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: AcBtnMgr_X63.exe.lnk = C:\Program Files\LexmarkX63\AcBtnMgr_X63.exe
O4 - Global Startup: ACMonitor_X63.exe.lnk = C:\Program Files\LexmarkX63\ACMonitor_X63.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\BigFix.exe
O4 - Global Startup: Cisco Systems VPN Client.lnk = C:\Program Files\Cisco Systems\VPN Client\vpngui.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Verizon Online Support Center.lnk = C:\Program Files\Verizon Online\SupportCenter\bin\matcli.exe
O9 - Extra button: Control Pad - {28D44DAD-D1FC-4d4f-BB1B-ADF037C8DDBC} - C:\Program Files\Verizon Online\Verizon Online Control Pad\VerizonControlPad.Exe
O9 - Extra 'Tools' menuitem: Control Pad - {28D44DAD-D1FC-4d4f-BB1B-ADF037C8DDBC} - C:\Program Files\Verizon Online\Verizon Online Control Pad\VerizonControlPad.Exe
O9 - Extra button: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O9 - Extra button: AOL Instant Messenger (SM) - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\aim\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com
O15 - Trusted Zone: *.hotmail.com
O15 - Trusted Zone: *.masstimes.org
O15 - Trusted Zone: *.sigalert.com
O15 - Trusted Zone: *.uiuc.edu
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: Gear Security Service (GEARSecurity) - GEAR Software - C:\WINDOWS\System32\gearsec.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Panda Firewall Service (PAVFIRES) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Firewall\PavFires.exe
O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PavFnSvr.exe
O23 - Service: Panda Pavkre (Pavkre) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Pavkre.exe
O23 - Service: Panda PavProt (PavProt) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PavProt.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\pavsrv51.exe
O23 - Service: Panda Preventium+ Service (PREVSRV) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\prevsrv.exe
O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software Internacional - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PsImSvc.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI