What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

pop ups galore

13 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
here is my hjt post
once Im clean can I print a copy of my log and later on delete any thing thats not on the sheet?
also is fox fire and better of a browser than ie?

Logfile of HijackThis v1.99.1
Scan saved at 3:50:07 PM, on 5/14/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\SYSTEM32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
E:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
E:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
E:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
E:\WINDOWS\Explorer.EXE
E:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LMPDPSRV.EXE
C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\Program Files\HP DVD\Umbrella\DVDTray.exe
C:\Program Files\Ahead\InCD\InCD.exe
E:\My Documents\deamon\daemon.exe
E:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Common Files\Ulead Systems\DVD\USISrv.exe
C:\Program Files\QuickTime\qttask.exe
E:\My Documents\iTunesHelper.exe
E:\WINDOWS\System32\dnsldpc.exe
C:\Program Files\iPod\bin\iPodService.exe
E:\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\CallWave\IAM.exe
C:\Program Files\Lexmark X125\LEX125SU.exe
C:\Program Files\InterMute\SpySubtract\SpySub.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\SpywareGuard\sgbhp.exe
E:\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\BitComet\BitComet.exe
C:\Program Files\Internet Explorer\iexplore.exe
E:\HJT\hijackthis_1\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://home.peoplepc.com/search
R3 - Default URLSearchHook is missing
O4 - HKLM\..\Run: [LMPDPSRV] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LMPDPSRV.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [DVDTray] "C:\Program Files\HP DVD\Umbrella\DVDTray.exe"
O4 - HKLM\..\Run: [DVDBitSet] "C:\Program Files\HP DVD\Umbrella\DVDBitSet.exe" /NOUI
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [gcasServ] "E:\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [DAEMON Tools-1033] "E:\My Documents\deamon\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [NeroFilterCheck] E:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HotKeysCmds] E:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [USIUDF_Eject_Monitor] C:\Program Files\Common Files\Ulead Systems\DVD\USISrv.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "E:\My Documents\iTunesHelper.exe"
O4 - HKLM\..\Run: [us3V3pg] dnsldpc.exe
O4 - HKLM\..\Run: [checkrun] E:\windows\system32\elitekjp32.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Internet Answering Machine.lnk = C:\Program Files\CallWave\IAM.exe
O4 - Global Startup: Lexmark X125 Settings Utility.lnk = C:\Program Files\Lexmark X125\LEX125SU.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: SpySubtract.lnk = C:\Program Files\InterMute\SpySubtract\SpySub.exe
O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EP…l_v1-0-3-12.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1093118623504
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab
O16 - DPF: {89D75D39-5531-47BA-9E4F-B346BA9C362C} (CWDL_DownLoadControl Class) - http://www.callwave.com/include/cab/CWDL_DownLoad.CAB
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {C02226EB-A5D7-4B1F-BD7E-635E46C2288D} (Toontown Installer ActiveX Control) - http://download.toontown.com/sv1.0.14.48/ttinst.cab
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://by101fd.bay101.hotmail.msn.com/activex/HMAtchmt.ocx
O17 - HKLM\System\CCS\Services\Tcpip\..\{73015B55-7813-4D4F-8822-AE7C5F1F102B}: NameServer = 4.2.2.1,4.2.2.2
O17 - HKLM\System\CCS\Services\Tcpip\..\{C09CB1FD-ECA9-418D-9F5C-4BEDCB3E3719}: NameServer = 151.199.0.39 151.199.0.38
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - E:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: Windows User Mode Driver Framework (UMWdf) - Unknown owner - C:\WINDOWS\System32\wdfmgr.exe (file missing)
Post #2
Download this tool: http://skads.org/special/rkfiles.zip
Unzip it to your Desktop.
Don't use it yet!

IMPORTANT! Reboot the computer into Safe Mode (tap F8 during bootup, use arrow keys to select Safe Mode, then hit 'enter').

Doubleclick LQfix.bat that you saved on your desktop before.
A doswindow will open and close again, that is normal.

Reboot into normal mode and scan with HijackThis. Post the new log as a reply to this thread.
Post #3
OK here's what happened
did as you said and unzipped rkfiles.zip to my desktop…
I got two files out of it—–1 "rkfiles.bat" and 2 "strings.exe"
I was thinking that you may have just misnamed the bat file or someone had changed the name of it…so I proceeded to start in safe mode and open the bat file.

a dos window did appear but never disappeared—-it was open about 20 min and didn't seem to be doing anything—here is what it read

1 file copied.
1 file copied.
1 file copied.
Please wait until this Dos window closes…post the contents of c:\log.tx
Checking system folders….
_

Maybe I didn't wait long enough but it had to be over 20 min—-I restarted in normal mode and this is my new log

by the way my microsoft antispyware alert says that an unknown startup program "strings.exe" requires approval—Do I allow or Block

Logfile of HijackThis v1.99.1
Scan saved at 4:52:56 AM, on 5/15/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\SYSTEM32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
E:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
E:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
E:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
E:\WINDOWS\Explorer.EXE
E:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LMPDPSRV.EXE
C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\Program Files\HP DVD\Umbrella\DVDTray.exe
C:\Program Files\Ahead\InCD\InCD.exe
E:\Microsoft AntiSpyware\gcasServ.exe
E:\WINDOWS\system32\rundll32.exe
E:\My Documents\deamon\daemon.exe
E:\WINDOWS\System32\hkcmd.exe
E:\Microsoft AntiSpyware\gcasDtServ.exe
E:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Common Files\Ulead Systems\DVD\USISrv.exe
C:\Program Files\QuickTime\qttask.exe
E:\My Documents\iTunesHelper.exe
E:\WINDOWS\System32\dnsldpc.exe
C:\Program Files\iPod\bin\iPodService.exe
E:\Microsoft AntiSpyware\gcasServAlert.exe
C:\Program Files\CallWave\IAM.exe
C:\Program Files\Lexmark X125\LEX125SU.exe
C:\Program Files\InterMute\SpySubtract\SpySub.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
E:\HJT\hijackthis_1\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://home.peoplepc.com/search
R3 - Default URLSearchHook is missing
O4 - HKLM\..\Run: [LMPDPSRV] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LMPDPSRV.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [DVDTray] "C:\Program Files\HP DVD\Umbrella\DVDTray.exe"
O4 - HKLM\..\Run: [DVDBitSet] "C:\Program Files\HP DVD\Umbrella\DVDBitSet.exe" /NOUI
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [gcasServ] "E:\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [DAEMON Tools-1033] "E:\My Documents\deamon\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [NeroFilterCheck] E:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HotKeysCmds] E:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [USIUDF_Eject_Monitor] C:\Program Files\Common Files\Ulead Systems\DVD\USISrv.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "E:\My Documents\iTunesHelper.exe"
O4 - HKLM\..\Run: [us3V3pg] dnsldpc.exe
O4 - HKLM\..\Run: [checkrun] E:\windows\system32\elitekjp32.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Internet Answering Machine.lnk = C:\Program Files\CallWave\IAM.exe
O4 - Global Startup: Lexmark X125 Settings Utility.lnk = C:\Program Files\Lexmark X125\LEX125SU.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: SpySubtract.lnk = C:\Program Files\InterMute\SpySubtract\SpySub.exe
O4 - Global Startup: strings.exe
O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EP…l_v1-0-3-12.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1093118623504
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab
O16 - DPF: {89D75D39-5531-47BA-9E4F-B346BA9C362C} (CWDL_DownLoadControl Class) - http://www.callwave.com/include/cab/CWDL_DownLoad.CAB
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {C02226EB-A5D7-4B1F-BD7E-635E46C2288D} (Toontown Installer ActiveX Control) - http://download.toontown.com/sv1.0.14.48/ttinst.cab
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://by101fd.bay101.hotmail.msn.com/activex/HMAtchmt.ocx
O17 - HKLM\System\CCS\Services\Tcpip\..\{73015B55-7813-4D4F-8822-AE7C5F1F102B}: NameServer = 4.2.2.1,4.2.2.2
O17 - HKLM\System\CCS\Services\Tcpip\..\{C09CB1FD-ECA9-418D-9F5C-4BEDCB3E3719}: NameServer = 151.199.0.39 151.199.0.38
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - E:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: Windows User Mode Driver Framework (UMWdf) - Unknown owner - C:\WINDOWS\System32\wdfmgr.exe (file missing)

thanks for your time and expertise
Post #5
I did as you said, it took a while but finished up
here is the new hjt log
I will also post the log the rkfiles.bat created and also another log was created just shortly after it ran. It was pretty long and listed all my drivers and looked like just about everything else that loaded up on my computer it was saved as ntbtlog.txt
if you need that log file I will post it

hjt log

Logfile of HijackThis v1.99.1
Scan saved at 7:53:12 AM, on 5/16/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\SYSTEM32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
E:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
E:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
E:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
E:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
E:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LMPDPSRV.EXE
C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\Program Files\HP DVD\Umbrella\DVDTray.exe
C:\Program Files\Ahead\InCD\InCD.exe
E:\My Documents\deamon\daemon.exe
E:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Common Files\Ulead Systems\DVD\USISrv.exe
C:\Program Files\AutoUpdate\AutoUpdate.exe
E:\WINDOWS\System32\repqh32.exe
E:\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\CallWave\IAM.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Lexmark X125\LEX125SU.exe
C:\Program Files\InterMute\SpySubtract\SpySub.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\Mozilla Firefox\firefox.exe
E:\HJT\hijackthis_1\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://home.peoplepc.com/search
R3 - Default URLSearchHook is missing
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - E:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [LMPDPSRV] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LMPDPSRV.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [DVDTray] "C:\Program Files\HP DVD\Umbrella\DVDTray.exe"
O4 - HKLM\..\Run: [DVDBitSet] "C:\Program Files\HP DVD\Umbrella\DVDBitSet.exe" /NOUI
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [gcasServ] "E:\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [DAEMON Tools-1033] "E:\My Documents\deamon\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [NeroFilterCheck] E:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HotKeysCmds] E:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [USIUDF_Eject_Monitor] C:\Program Files\Common Files\Ulead Systems\DVD\USISrv.exe
O4 - HKLM\..\Run: [checkrun] E:\windows\system32\elitekjp32.exe
O4 - HKLM\..\Run: [AutoUpdater] "C:\Program Files\AutoUpdate\AutoUpdate.exe"
O4 - HKLM\..\Run: [us3V3pg] repqh32.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Internet Answering Machine.lnk = C:\Program Files\CallWave\IAM.exe
O4 - Global Startup: Lexmark X125 Settings Utility.lnk = C:\Program Files\Lexmark X125\LEX125SU.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: SpySubtract.lnk = C:\Program Files\InterMute\SpySubtract\SpySub.exe
O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EP…l_v1-0-3-12.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1093118623504
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab
O16 - DPF: {89D75D39-5531-47BA-9E4F-B346BA9C362C} (CWDL_DownLoadControl Class) - http://www.callwave.com/include/cab/CWDL_DownLoad.CAB
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {C02226EB-A5D7-4B1F-BD7E-635E46C2288D} (Toontown Installer ActiveX Control) - http://download.toontown.com/sv1.0.14.48/ttinst.cab
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://by101fd.bay101.hotmail.msn.com/activex/HMAtchmt.ocx
O17 - HKLM\System\CCS\Services\Tcpip\..\{73015B55-7813-4D4F-8822-AE7C5F1F102B}: NameServer = 4.2.2.1,4.2.2.2
O17 - HKLM\System\CCS\Services\Tcpip\..\{C09CB1FD-ECA9-418D-9F5C-4BEDCB3E3719}: NameServer = 151.199.0.39 151.199.0.38
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - E:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe



rkfiles.bat log



E:\Documents and Settings\All Users.HOME-P0XN8QNVLI\Desktop

PLEASE NOTE THAT ALL FILES FOUND BY THIS METHOD ARE NOT BAD FILES, THERE MIGHT BE LEGIT FILES LISTED AND PLEASE BE CAREFUL WHILE FIXING. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.
Files Found in system Folder…………
————————
E:\WINDOWS\system32\ps1.exe: UPX!
E:\WINDOWS\system32\qtalt.ax: UPX!
E:\WINDOWS\system32\rmalt.ax: UPX!
E:\WINDOWS\system32\eliteghj32.exe: FSG!
E:\WINDOWS\system32\elitekjp32.exe: FSG!
E:\WINDOWS\system32\dfrg.msc: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAwGpEc213
E:\WINDOWS\system32\n8im7.exe: PEC2
E:\WINDOWS\system32\n8m.sys: PEC2
E:\WINDOWS\n8m.sys: PEC2

Files Found in all users startup Folder…………
————————
Files Found in all users windows Folder…………
————————
E:\WINDOWS\choice.exe: UPX!
E:\WINDOWS\daemon.dll: UPX!
E:\WINDOWS\tool.exe: UPX!
E:\WINDOWS\tool1.exe: UPX!
E:\WINDOWS\tsc.exe: UPX!
E:\WINDOWS\vsapi32.dll: UPX!t4
Finished
bye
Post #8
I did just as you ask
Here is the new hjt log–I don't have people pc any more can I delete that search bar in my scan? also if you need the log for adaware I can post that too. It found 43 problems—-again thankyou for your time and knowledge!



Logfile of HijackThis v1.99.1
Scan saved at 6:31:08 AM, on 5/18/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\SYSTEM32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
E:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
E:\WINDOWS\System32\wuauclt.exe
E:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LMPDPSRV.EXE
C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\Program Files\HP DVD\Umbrella\DVDTray.exe
C:\Program Files\Ahead\InCD\InCD.exe
E:\Microsoft AntiSpyware\gcasServ.exe
E:\My Documents\deamon\daemon.exe
E:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Common Files\Ulead Systems\DVD\USISrv.exe
E:\WINDOWS\System32\repqh32.exe
C:\Program Files\Java\j2re1.4.2_05\bin\jucheck.exe
C:\Program Files\CallWave\IAM.exe
E:\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Lexmark X125\LEX125SU.exe
C:\Program Files\InterMute\SpySubtract\SpySub.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
E:\HJT\hijackthis_1\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://home.peoplepc.com/search
R3 - Default URLSearchHook is missing
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - E:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [LMPDPSRV] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LMPDPSRV.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [DVDTray] "C:\Program Files\HP DVD\Umbrella\DVDTray.exe"
O4 - HKLM\..\Run: [DVDBitSet] "C:\Program Files\HP DVD\Umbrella\DVDBitSet.exe" /NOUI
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [gcasServ] "E:\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [DAEMON Tools-1033] "E:\My Documents\deamon\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [NeroFilterCheck] E:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HotKeysCmds] E:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [USIUDF_Eject_Monitor] C:\Program Files\Common Files\Ulead Systems\DVD\USISrv.exe
O4 - HKLM\..\Run: [us3V3pg] repqh32.exe
O4 - HKLM\..\Run: [checkrun] E:\windows\system32\elitekjp32.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Internet Answering Machine.lnk = C:\Program Files\CallWave\IAM.exe
O4 - Global Startup: Lexmark X125 Settings Utility.lnk = C:\Program Files\Lexmark X125\LEX125SU.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: SpySubtract.lnk = C:\Program Files\InterMute\SpySubtract\SpySub.exe
O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EP…l_v1-0-3-12.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1093118623504
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab
O16 - DPF: {89D75D39-5531-47BA-9E4F-B346BA9C362C} (CWDL_DownLoadControl Class) - http://www.callwave.com/include/cab/CWDL_DownLoad.CAB
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {C02226EB-A5D7-4B1F-BD7E-635E46C2288D} (Toontown Installer ActiveX Control) - http://download.toontown.com/sv1.0.14.48/ttinst.cab
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://by101fd.bay101.hotmail.msn.com/activex/HMAtchmt.ocx
O17 - HKLM\System\CCS\Services\Tcpip\..\{73015B55-7813-4D4F-8822-AE7C5F1F102B}: NameServer = 4.2.2.1,4.2.2.2
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
Post #9
Scan with hijackthis and put a check beside these lines and choose FIX

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://home.peoplepc.com/search

R3 - Default URLSearchHook is missing

O4 - HKLM\..\Run: [us3V3pg] repqh32.exe
O4 - HKLM\..\Run: [checkrun] E:\windows\system32\elitekjp32.exe

O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EP…l_v1-0-3-12.cab
O16 - DPF: {C02226EB-A5D7-4B1F-BD7E-635E46C2288D} (Toontown Installer ActiveX Control) - http://download.toontown.com/sv1.0.14.48/ttinst.cab

Then reboot and post a new log please.
Post #10
did just as you said and as soon as i hit fix warnings started poping up saying that your searchbar has been changed and that bho have been added. here is the new scan


Logfile of HijackThis v1.99.1
Scan saved at 6:10:37 AM, on 5/19/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\SYSTEM32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
E:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
E:\WINDOWS\Explorer.EXE
E:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LMPDPSRV.EXE
C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\Program Files\HP DVD\Umbrella\DVDTray.exe
C:\Program Files\Java\j2re1.4.2_05\bin\jucheck.exe
C:\Program Files\Ahead\InCD\InCD.exe
E:\Microsoft AntiSpyware\gcasServ.exe
E:\My Documents\deamon\daemon.exe
E:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Common Files\Ulead Systems\DVD\USISrv.exe
E:\Microsoft AntiSpyware\gcasDtServ.exe
E:\WINDOWS\System32\mszsam11.exe
C:\Program Files\CallWave\IAM.exe
C:\Program Files\Lexmark X125\LEX125SU.exe
C:\Program Files\InterMute\SpySubtract\SpySub.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
E:\HJT\hijackthis_1\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://home.peoplepc.com/search
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - E:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [LMPDPSRV] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LMPDPSRV.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [DVDTray] "C:\Program Files\HP DVD\Umbrella\DVDTray.exe"
O4 - HKLM\..\Run: [DVDBitSet] "C:\Program Files\HP DVD\Umbrella\DVDBitSet.exe" /NOUI
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [gcasServ] "E:\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [DAEMON Tools-1033] "E:\My Documents\deamon\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [NeroFilterCheck] E:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HotKeysCmds] E:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [USIUDF_Eject_Monitor] C:\Program Files\Common Files\Ulead Systems\DVD\USISrv.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [fBs9RfMme] mszsam11.exe
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Internet Answering Machine.lnk = C:\Program Files\CallWave\IAM.exe
O4 - Global Startup: Lexmark X125 Settings Utility.lnk = C:\Program Files\Lexmark X125\LEX125SU.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: SpySubtract.lnk = C:\Program Files\InterMute\SpySubtract\SpySub.exe
O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1093118623504
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab
O16 - DPF: {89D75D39-5531-47BA-9E4F-B346BA9C362C} (CWDL_DownLoadControl Class) - http://www.callwave.com/include/cab/CWDL_DownLoad.CAB
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://by101fd.bay101.hotmail.msn.com/activex/HMAtchmt.ocx
O17 - HKLM\System\CCS\Services\Tcpip\..\{73015B55-7813-4D4F-8822-AE7C5F1F102B}: NameServer = 4.2.2.1,4.2.2.2
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

again thanks for your time and your expertise
Post #11
YOu need to disable Spywareguard or it may block any fixes.

Boot to safe mode scan with hijackthis and put a check beside these lines


R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://home.peoplepc.com/search

O4 - HKCU\..\Run: [fBs9RfMme] mszsam11.exe

Then reboot to normal mode and post a new log please.
Post #12
Here is the new hjt log
I dont seam to have all the pop ups now but something still seams to be arighe
Still moving pretty slow



Logfile of HijackThis v1.99.1
Scan saved at 7:24:55 PM, on 5/19/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\SYSTEM32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
E:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
E:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LMPDPSRV.EXE
C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\Program Files\HP DVD\Umbrella\DVDTray.exe
C:\Program Files\Ahead\InCD\InCD.exe
E:\My Documents\deamon\daemon.exe
E:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Common Files\Ulead Systems\DVD\USISrv.exe
C:\Program Files\AutoUpdate\AutoUpdate.exe
C:\Program Files\CallWave\IAM.exe
E:\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Lexmark X125\LEX125SU.exe
E:\WINDOWS\System32\wuauclt.exe
C:\Program Files\InterMute\SpySubtract\SpySub.exe
C:\Program Files\SpywareGuard\sgmain.exe
E:\HJT\hijackthis_1\HijackThis.exe

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - E:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [LMPDPSRV] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LMPDPSRV.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [DVDTray] "C:\Program Files\HP DVD\Umbrella\DVDTray.exe"
O4 - HKLM\..\Run: [DVDBitSet] "C:\Program Files\HP DVD\Umbrella\DVDBitSet.exe" /NOUI
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [gcasServ] "E:\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [DAEMON Tools-1033] "E:\My Documents\deamon\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [NeroFilterCheck] E:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HotKeysCmds] E:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [USIUDF_Eject_Monitor] C:\Program Files\Common Files\Ulead Systems\DVD\USISrv.exe
O4 - HKLM\..\Run: [AutoUpdater] "C:\Program Files\AutoUpdate\AutoUpdate.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Internet Answering Machine.lnk = C:\Program Files\CallWave\IAM.exe
O4 - Global Startup: Lexmark X125 Settings Utility.lnk = C:\Program Files\Lexmark X125\LEX125SU.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: SpySubtract.lnk = C:\Program Files\InterMute\SpySubtract\SpySub.exe
O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1093118623504
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab
O16 - DPF: {89D75D39-5531-47BA-9E4F-B346BA9C362C} (CWDL_DownLoadControl Class) - http://www.callwave.com/include/cab/CWDL_DownLoad.CAB
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://by101fd.bay101.hotmail.msn.com/activex/HMAtchmt.ocx
O17 - HKLM\System\CCS\Services\Tcpip\..\{0716976C-1C1E-45B0-9A7A-BA6F1320A80C}: NameServer = 4.2.2.1,4.2.2.2
O17 - HKLM\System\CCS\Services\Tcpip\..\{73015B55-7813-4D4F-8822-AE7C5F1F102B}: NameServer = 4.2.2.1,4.2.2.2
O17 - HKLM\System\CS1\Services\Tcpip\..\{0716976C-1C1E-45B0-9A7A-BA6F1320A80C}: NameServer = 4.2.2.1,4.2.2.2
O17 - HKLM\System\CS2\Services\Tcpip\..\{0716976C-1C1E-45B0-9A7A-BA6F1320A80C}: NameServer = 4.2.2.1,4.2.2.2
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

thanks again for your expertise and your time
Post #13
Please download MicroWorld scanner for the link below. Make sure that you choose all files and directories. I warn that the scan will tak a long time and will not fix anything. Once the scan is completed in the LOWER box hilight all the files there then copy (ctrl +c) and paste it into the thread please.

Here >>>> http://www.mwti.net/antivirus/mwav.asp
Post #14
I guess you knew that this was going to be a long post .well here goes. again thanks for your time and know how… Object "IBIS Spyware/Adware" found in File System! Action Taken: No Action Taken. Object "Alexa Spyware/Adware" found in File System! Action Taken: No Action Taken. Object "DealHelper Spyware/Adware" found in File System! Action Taken: No Action Taken. Object "HuntBar Spyware/Adware" found in File System! Action Taken: No Action Taken. Object "AltNet Spyware/Adware" found in File System! Action Taken: No Action Taken. Object "mxoaldr Spyware/Adware" found in File System! Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "E:\WINDOWS\System32\LegitCheckControl.DLL". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\Downloaded Program Files\EPUWALcontrol.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\Downloaded Program Files\ttinst.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{06F6B684-D783-494B-A3F7-26FA369AA8FD" refers to invalid object "blank". Action Taken: No Action Taken. Entry "HKCR\CLSID\{1F6A0602-D0D1-4770-9681-0F1CC758B447" refers to invalid object "blank". Action Taken: No Action Taken. Entry "HKCR\CLSID\{2DE3F90D-ACA9-4AC8-9033-DE2F360C4F7A}" refers to invalid object "blank". Action Taken: No Action Taken. Entry "HKCR\CLSID\{32020A01-506E-484D-A2A8-BE3CF17601C3}" refers to invalid object "blank". Action Taken: No Action Taken. Entry "HKCR\CLSID\{382EDE1A-041E-4A6D-A451-F27536941057" refers to invalid object "blank". Action Taken: No Action Taken. Entry "HKCR\CLSID\{4966A6E3-D77A-42D5-9BC0-EED2215430D7}" refers to invalid object "blank". Action Taken: No Action Taken. Entry "HKCR\CLSID\{4A05736D-9A14-43CC-867C-07D2BC9B4EBF" refers to invalid object "blank". Action Taken: No Action Taken. Entry "HKCR\CLSID\{4EC0690F-EA6F-4573-845F-782AD19F35DB}" refers to invalid object "blank". Action Taken: No Action Taken. Entry "HKCR\CLSID\{72E88BCE-4132-11D4-986A-0020781640F6" refers to invalid object "blank". Action Taken: No Action Taken. Entry "HKCR\CLSID\{78A42AD8-2CFC-49D5-82C6-248B756F32EA}" refers to invalid object "COMCTL32.OCX". Action Taken: No Action Taken. Entry "HKCR\CLSID\{85D32B5A-409A-42CD-8DE7-D31373C7F3AB}" refers to invalid object "blank". Action Taken: No Action Taken. Entry "HKCR\CLSID\{8c3c1b17-e59d-11d2-b40b-00a024b9dddd}" refers to invalid object "blank". Action Taken: No Action Taken. Entry "HKCR\CLSID\{99180163-DA16-101A-935C-444553540000}" refers to invalid object "recncl.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{AA7E2086-CB55-11D2-8094-00104B1F9838}" refers to invalid object "blank". Action Taken: No Action Taken. Entry "HKCR\CLSID\{AA7E2087-CB55-11D2-8094-00104B1F9838}" refers to invalid object "blank". Action Taken: No Action Taken. Entry "HKCR\CLSID\{B582769D-392A-4172-ABF8-860064207EFC" refers to invalid object "blank". Action Taken: No Action Taken. Entry "HKCR\CLSID\{C00A9344-3738-44F8-F571-9291F322B905}" refers to invalid object "blank". Action Taken: No Action Taken. Entry "HKCR\CLSID\{C46FF1FF-78EF-4939-8B00-46273B7B8EE1}" refers to invalid object "blank". Action Taken: No Action Taken. Entry "HKCR\CLSID\{C9CD1A93-D7B4-11D2-80C5-00104B1F6CEA}" refers to invalid object "blank". Action Taken: No Action Taken. Entry "HKCR\CLSID\{E0E98A24-9C44-4F7C-B739-BA05D2965400}" refers to invalid object "blank". Action Taken: No Action Taken. Entry "HKCR\CLSID\{E7C165A4-EB19-4A55-BABB-E8FBA3AC8C67" refers to invalid object "blank". Action Taken: No Action Taken. Entry "HKCR\CLSID\{F661DC11-4D60-4A50-ABA9-602FC4B54FEE}" refers to invalid object "blank". Action Taken: No Action Taken. Entry "HKCR\ActMsg.Session" refers to invalid object "{3FA7DEB3-6438-101B-ACC1-00AA00423326}". Action Taken: No Action Taken. Entry "HKCR\ComDialer.DialerApp.1" refers to invalid object "{667CD401-36AD-4334-B1F6-0D063B4C26B3}". Action Taken: No Action Taken. Entry "HKCR\ComPlusMetaData.MsCorHost" refers to invalid object "{727CDF4F-3BA0-11D3-8738-00C04F79ED0D}". Action Taken: No Action Taken. Entry "HKCR\ComPlusMetaData.MsCorHost.2" refers to invalid object "{727CDF4F-3BA0-11D3-8738-00C04F79ED0D}". Action Taken: No Action Taken. Entry "HKCR\DAIE.DownloadAcceleratorIE" refers to invalid object "{5BFA1DAF-5EDC-11D2-959E-00C00C02DA5E}". Action Taken: No Action Taken. Entry "HKCR\DAIE.DownloadAcceleratorIE.1" refers to invalid object "{5BFA1DAF-5EDC-11D2-959E-00C00C02DA5E}". Action Taken: No Action Taken. Entry "HKCR\Dms.DialManager.1" refers to invalid object "{4A05736D-9A14-43CC-867C-07D2BC9B4EBF}". Action Taken: No Action Taken. Entry "HKCR\MailFileAtt" refers to invalid object "{00020D05-0000-0000-C000-000000000046}". Action Taken: No Action Taken. Entry "HKCR\mapifvbx.object" refers to invalid object "{41116C00-8B90-101B-96CD-00AA003B14FC}". Action Taken: No Action Taken. Entry "HKCR\mapifvbx.object.1" refers to invalid object "{41116C00-8B90-101B-96CD-00AA003B14FC}". Action Taken: No Action Taken. Entry "HKCR\Plenoptic.Plenoptic" refers to invalid object "{607C27E9-AB27-11d3-A116-A0EA50C10801}". Action Taken: No Action Taken. Entry "HKCR\Plenoptic.Plenoptic.1" refers to invalid object "{607C27E9-AB27-11d3-A116-A0EA50C10801}". Action Taken: No Action Taken. Entry "HKCR\SpywareGuardDLBLOCK.CBrowserHelper" refers to invalid object "{4A368E80-174F-4872-96B5-0B27DDD11DB2}". Action Taken: No Action Taken. Entry "HKCR\SymWriter.pdb" refers to invalid object "{520DC67A-752E-11D3-8D56-00C04F680B2B}". Action Taken: No Action Taken. Entry "HKCR\WMPPublsihCntr.WMPPublsihCntr" refers to invalid object "{939438A9-CF0F-44d8-9140-599736F0D3A2}". Action Taken: No Action Taken. Entry "HKCR\WMPPublsihCntr.WMPPublsihCntr.1" refers to invalid object "{939438A9-CF0F-44d8-9140-599736F0D3A2}". Action Taken: No Action Taken. Entry "HKCR\WMPShell.HWEventHandler" refers to invalid object "{9B186A8F-F520-4eeb-B553-118304AC46C5}". Action Taken: No Action Taken. Entry "HKCR\WMPShell.HWEventHandler.1" refers to invalid object "{9B186A8F-F520-4eeb-B553-118304AC46C5}". Action Taken: No Action Taken. Entry "HKCR\WMSServer.Server" refers to invalid object "{845FB959-4279-11D2-BF23-00805FBE84A6}". Action Taken: No Action Taken. Entry "HKCR\WMSServer.Server.9" refers to invalid object "{845FB959-4279-11D2-BF23-00805FBE84A6}". Action Taken: No Action Taken. File E:\WINDOWS\fursdqpb.exe tagged as "not-a-virus:AdWare.BookedSpace.e". Action Taken: No Action Taken. File E:\WINDOWS\n8m.sys infected by "Trojan.Win32.Delf.cf" Virus! Action Taken: No Action Taken. File E:\WINDOWS\tool1.exe infected by "Trojan.Win32.LowZones.y" Virus! Action Taken: No Action Taken. File E:\WINDOWS\System32\5rlicv.exe infected by "Trojan.Win32.Delf.cf" Virus! Action Taken: No Action Taken. File E:\WINDOWS\System32\bucq.dll infected by "Trojan.Win32.Delf.cf" Virus! Action Taken: No Action Taken. File E:\WINDOWS\System32\h9h.dll infected by "Trojan.Win32.Delf.cf" Virus! Action Taken: No Action Taken. File E:\WINDOWS\System32\n5v.exe infected by "Trojan.Win32.Delf.cf" Virus! Action Taken: No Action Taken. File E:\WINDOWS\System32\n8im7.exe infected by "Trojan.Win32.Delf.cf" Virus! Action Taken: No Action Taken. File E:\WINDOWS\System32\n8m.sys infected by "Trojan.Win32.Delf.cf" Virus! Action Taken: No Action Taken. File E:\WINDOWS\System32\ps1.exe tagged as "not-a-virus:AdWare.Pacer.h". Action Taken: No Action Taken. File E:\DOCUME~1\ALLUSE~1.HOM\LOCALS~1\Temp\n8m.sys infected by "Trojan.Win32.Delf.cf" Virus! Action Taken: No Action Taken. File E:\DOCUME~1\ALLUSE~1.HOM\LOCALS~1\Temp\toc_0036.exe infected by "Trojan-Downloader.Win32.Agent.jq" Virus! Action Taken: No Action Taken. File E:\DOCUME~1\ALLUSE~1.HOM\LOCALS~1\TEMPOR~1\Content.IE5\29OZYPI1\eied_s7_70[1].cab infected by "Trojan-Downloader.Win32.Mediket.ag" Virus! Action Taken: No Action Taken. File E:\DOCUME~1\ALLUSE~1.HOM\LOCALS~1\TEMPOR~1\Content.IE5\29OZYPI1\winupdate70563636[1].exe infected by "Trojan-Dropper.Win32.Small.ue" Virus! Action Taken: No Action Taken. File E:\DOCUME~1\ALLUSE~1.HOM\LOCALS~1\TEMPOR~1\Content.IE5\BTGMVNY2\AutoUpdaterInstaller[1].exe infected by "Trojan-Downloader.Win32.Apropo.g" Virus! Action Taken: No Action Taken. File E:\DOCUME~1\ALLUSE~1.HOM\LOCALS~1\TEMPOR~1\Content.IE5\C5CL2R8X\eied_s7[1].chm infected by "Exploit.HTML.CodeBaseExec" Virus! Action Taken: No Action Taken. File E:\DOCUME~1\ALLUSE~1.HOM\LOCALS~1\TEMPOR~1\Content.IE5\C5CL2R8X\winupdate59496355[1].exe infected by "Trojan-Dropper.Win32.Small.ue" Virus! Action Taken: No Action Taken. File E:\DOCUME~1\ALLUSE~1.HOM\LOCALS~1\TEMPOR~1\Content.IE5\CPWJGZ0V\status[1] infected by "Trojan-Downloader.Win32.Apropo.ab" Virus! Action Taken: No Action Taken. File E:\CABS\WIN98_66.CAB tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File E:\Documents and Settings\All Users.HOME-P0XN8QNVLI\Local Settings\Temp\n8m.sys infected by "Trojan.Win32.Delf.cf" Virus! Action Taken: No Action Taken. File E:\Documents and Settings\All Users.HOME-P0XN8QNVLI\Local Settings\Temp\toc_0036.exe infected by "Trojan-Downloader.Win32.Agent.jq" Virus! Action Taken: No Action Taken. File E:\Documents and Settings\All Users.HOME-P0XN8QNVLI\Local Settings\Temporary Internet Files\Content.IE5\29OZYPI1\eied_s7_70[1].cab infected by "Trojan-Downloader.Win32.Mediket.ag" Virus! Action Taken: No Action Taken. File E:\Documents and Settings\All Users.HOME-P0XN8QNVLI\Local Settings\Temporary Internet Files\Content.IE5\29OZYPI1\winupdate70563636[1].exe infected by "Trojan-Dropper.Win32.Small.ue" Virus! Action Taken: No Action Taken. File E:\Documents and Settings\All Users.HOME-P0XN8QNVLI\Local Settings\Temporary Internet Files\Content.IE5\BTGMVNY2\AutoUpdaterInstaller[1].exe infected by "Trojan-Downloader.Win32.Apropo.g" Virus! Action Taken: No Action Taken. File E:\Documents and Settings\All Users.HOME-P0XN8QNVLI\Local Settings\Temporary Internet Files\Content.IE5\C5CL2R8X\eied_s7[1].chm infected by "Exploit.HTML.CodeBaseExec" Virus! Action Taken: No Action Taken. File E:\Documents and Settings\All Users.HOME-P0XN8QNVLI\Local Settings\Temporary Internet Files\Content.IE5\C5CL2R8X\winupdate59496355[1].exe infected by "Trojan-Dropper.Win32.Small.ue" Virus! Action Taken: No Action Taken. File E:\Documents and Settings\All Users.HOME-P0XN8QNVLI\Local Settings\Temporary Internet Files\Content.IE5\CPWJGZ0V\status[1] infected by "Trojan-Downloader.Win32.Apropo.ab" Virus! Action Taken: No Action Taken. File E:\Documents and Settings\devin\Local Settings\Temp\n8m.sys infected by "Trojan.Win32.Delf.cf" Virus! Action Taken: No Action Taken. File E:\Documents and Settings\devin\Local Settings\Temp\p5qxgd.sys infected by "Trojan.Win32.Delf.cf" Virus! Action Taken: No Action Taken. File E:\Documents and Settings\rena\Local Settings\Temp\n8m.sys infected by "Trojan.Win32.Delf.cf" Virus! Action Taken: No Action Taken. File E:\Documents and Settings\rena\Local Settings\Temp\p5qxgd.sys infected by "Trojan.Win32.Delf.cf" Virus! Action Taken: No Action Taken. File E:\HJT\hijackthis_1\backups\backup-20050509-055735-959.dll infected by "Trojan.Win32.Delf.cf" Virus! Action Taken: No Action Taken. File E:\Microsoft AntiSpyware\Quarantine\26E449D9-7D5F-4D7A-8C89-294597\26E49366-5D3E-417D-A528-98171D infected by "Trojan-Downloader.Win32.VB.eu" Virus! Action Taken: No Action Taken. File E:\Microsoft AntiSpyware\Quarantine\26E449D9-7D5F-4D7A-8C89-294597\CBB0FCA5-4057-4FA4-8B2B-BD1AAA infected by "Trojan-Downloader.Win32.VB.eu" Virus! Action Taken: No Action Taken. File E:\Microsoft AntiSpyware\Quarantine\32DA71A4-F628-4538-9991-829CBF\663B1164-1CEB-4E58-A413-A19023 tagged as "not-a-virus:AdWare.VirtualBouncer.g". Action Taken: No Action Taken. File E:\Microsoft AntiSpyware\Quarantine\32DA71A4-F628-4538-9991-829CBF\CD84D0AF-41D0-4F70-A10A-C0485D tagged as "not-a-virus:AdWare.VirtualBouncer.g". Action Taken: No Action Taken. File E:\Microsoft AntiSpyware\Quarantine\32DA71A4-F628-4538-9991-829CBF\D0D7BACB-9A1A-42E3-9BF1-9DA161 tagged as "not-a-virus:AdWare.VirtualBouncer.g". Action Taken: No Action Taken. File E:\Microsoft AntiSpyware\Quarantine\3BE1B9FC-C939-42EF-AB0E-B428A8\93B7DE34-DBF1-4E87-AFDC-49DBF0 tagged as "not-a-virus:AdWare.VirtualBouncer.i". Action Taken: No Action Taken. File E:\Microsoft AntiSpyware\Quarantine\4B228493-2D81-42DA-BB85-CB3BC8\F2A0C6F8-5AF5-41D7-A2C3-7C6E55 tagged as "not-a-virus:AdWare.VirtualBouncer.g". Action Taken: No Action Taken. File E:\Microsoft AntiSpyware\Quarantine\4EDB078B-A9A8-4A22-9C60-C856F8\1446FD86-14B8-4B6F-9ED0-4815F9 tagged as "not-a-virus:AdWare.VirtualBouncer". Action Taken: No Action Taken. File E:\Microsoft AntiSpyware\Quarantine\4EDB078B-A9A8-4A22-9C60-C856F8\2BE89CDE-E50A-4A6C-BD06-9A1446 tagged as "not-a-virus:AdWare.VirtualBouncer.i". Action Taken: No Action Taken. File E:\Microsoft AntiSpyware\Quarantine\4EDB078B-A9A8-4A22-9C60-C856F8\A392BBC9-0673-4952-8EE7-02DD08 tagged as "not-a-virus:AdWare.VirtualBouncer.i". Action Taken: No Action Taken. File E:\Microsoft AntiSpyware\Quarantine\4EDB078B-A9A8-4A22-9C60-C856F8\C6796853-665A-4B14-A96A-ED7C96 tagged as "not-a-virus:AdWare.VirtualBouncer.i". Action Taken: No Action Taken. File E:\Microsoft AntiSpyware\Quarantine\4EDB078B-A9A8-4A22-9C60-C856F8\DF55FFD8-53E5-4730-A226-FC85E5 tagged as "not-a-virus:AdWare.VirtualBouncer.j". Action Taken: No Action Taken. File E:\Microsoft AntiSpyware\Quarantine\85563FE8-072F-47D8-BAC2-6DFC64\E27C2F60-1EF1-400F-87D2-266BCE tagged as "not-a-virus:AdWare.Wintol.ab". Action Taken: No Action Taken. File E:\Microsoft AntiSpyware\Quarantine\8D922765-A49B-470E-9768-CBE884\0C382A15-028D-45C2-B9D9-E76E0D tagged as "not-a-virus:AdWare.BargainBuddy.l". Action Taken: No Action Taken. File E:\Microsoft AntiSpyware\Quarantine\8D922765-A49B-470E-9768-CBE884\11C82696-D2EC-4047-A1F3-AEE521 tagged as "not-a-virus:AdWare.CashBack.e". Action Taken: No Action Taken. File E:\Microsoft AntiSpyware\Quarantine\8D922765-A49B-470E-9768-CBE884\875E081E-46CA-4ED9-BDE1-2357DC tagged as "not-a-virus:AdWare.BargainBuddy.n". Action Taken: No Action Taken. File E:\System Volume Information\_restore{59467B53-1752-4F0F-B918-B2C6A59A47B1}\RP103\A0014817.exe infected by "Trojan-Downloader.Win32.Delf.go" Virus! Action Taken: No Action Taken. File E:\System Volume Information\_restore{59467B53-1752-4F0F-B918-B2C6A59A47B1}\RP120\A0018477.exe infected by "Trojan-Downloader.Win32.Delf.dg" Virus! Action Taken: No Action Taken. File E:\System Volume Information\_restore{59467B53-1752-4F0F-B918-B2C6A59A47B1}\RP131\A0019048.ax tagged as "not-a-virus:AdWare.BargainBuddy.l". Action Taken: No Action Taken. File E:\System Volume Information\_restore{59467B53-1752-4F0F-B918-B2C6A59A47B1}\RP131\A0019083.exe infected by "Trojan-Downloader.Win32.Small.aqt" Virus! Action Taken: No Action Taken. File E:\System Volume Information\_restore{59467B53-1752-4F0F-B918-B2C6A59A47B1}\RP138\A0019427.exe infected by "Trojan.Win32.StartPage.nk" Virus! Action Taken: No Action Taken. File E:\System Volume Information\_restore{59467B53-1752-4F0F-B918-B2C6A59A47B1}\RP138\A0019428.exe infected by "Trojan.Win32.StartPage.nk" Virus! Action Taken: No Action Taken. File E:\System Volume Information\_restore{59467B53-1752-4F0F-B918-B2C6A59A47B1}\RP138\A0019429.dll tagged as "not-a-virus:AdWare.ToolBar.EliteBar.z". Action Taken: No Action Taken. File E:\System Volume Information\_restore{59467B53-1752-4F0F-B918-B2C6A59A47B1}\RP138\A0019430.dll tagged as "not-a-virus:AdWare.ToolBar.EliteBar.af". Action Taken: No Action Taken. File E:\System Volume Information\_restore{59467B53-1752-4F0F-B918-B2C6A59A47B1}\RP32\A0007719.exe infected by "Trojan.Win32.Agent.bi" Virus! Action Taken: No Action Taken. File E:\System Volume Information\_restore{59467B53-1752-4F0F-B918-B2C6A59A47B1}\RP32\A0007725.exe infected by "Trojan.Win32.Agent.bi" Virus! Action Taken: No Action Taken. File E:\System Volume Information\_restore{59467B53-1752-4F0F-B918-B2C6A59A47B1}\RP32\A0007728.exe infected by "Trojan.Win32.Agent.bi" Virus! Action Taken: No Action Taken. File E:\System Volume Information\_restore{59467B53-1752-4F0F-B918-B2C6A59A47B1}\RP34\A0007764.exe infected by "Trojan.Win32.Agent.bi" Virus! Action Taken: No Action Taken. File E:\System Volume Information\_restore{59467B53-1752-4F0F-B918-B2C6A59A47B1}\RP35\A0007779.exe infected by "Trojan.Win32.Agent.bi" Virus! Action Taken: No Action Taken. File E:\System Volume Information\_restore{59467B53-1752-4F0F-B918-B2C6A59A47B1}\RP35\A0008779.exe infected by "Trojan.Win32.Agent.bi" Virus! Action Taken: No Action Taken. File E:\System Volume Information\_restore{59467B53-1752-4F0F-B918-B2C6A59A47B1}\RP35\A0008780.exe infected by "Trojan.Win32.Agent.bi" Virus! Action Taken: No Action Taken. File E:\System Volume Information\_restore{59467B53-1752-4F0F-B918-B2C6A59A47B1}\RP35\A0008782.dll tagged as "not-a-virus:AdWare.SearchPage". Action Taken: No Action Taken. File E:\System Volume Information\_restore{59467B53-1752-4F0F-B918-B2C6A59A47B1}\RP35\A0008783.exe infected by "Trojan.Win32.Agent.bi" Virus! Action Taken: No Action Taken. File E:\System Volume Information\_restore{59467B53-1752-4F0F-B918-B2C6A59A47B1}\RP38\A0008822.exe infected by "Trojan.Win32.Agent.bi" Virus! Action Taken: No Action Taken. File E:\System Volume Information\_restore{59467B53-1752-4F0F-B918-B2C6A59A47B1}\RP38\A0008825.exe infected by "Trojan.Win32.Agent.bi" Virus! Action Taken: No Action Taken. File E:\System Volume Information\_restore{59467B53-1752-4F0F-B918-B2C6A59A47B1}\RP38\A0010822.exe infected by "Trojan.Win32.Agent.bi" Virus! Action Taken: No Action Taken. File E:\System Volume Information\_restore{59467B53-1752-4F0F-B918-B2C6A59A47B1}\RP38\A0010846.dll tagged as "not-a-virus:AdWare.SearchPage". Action Taken: No Action Taken. File E:\System Volume Information\_restore{59467B53-1752-4F0F-B918-B2C6A59A47B1}\RP38\A0010847.dll tagged as "not-a-virus:AdWare.SearchPage". Action Taken: No Action Taken. File E:\System Volume Information\_restore{59467B53-1752-4F0F-B918-B2C6A59A47B1}\RP38\A0010848.exe infected by "Trojan.Win32.Agent.bi" Virus! Action Taken: No Action Taken. File E:\System Volume Information\_restore{59467B53-1752-4F0F-B918-B2C6A59A47B1}\RP38\A0010857.exe infected by "Trojan.Win32.Agent.bi" Virus! Action Taken: No Action Taken. File E:\System Volume Information\_restore{59467B53-1752-4F0F-B918-B2C6A59A47B1}\RP38\A0010858.exe infected by "Trojan.Win32.Agent.bi" Virus! Action Taken: No Action Taken. File E:\System Volume Information\_restore{59467B53-1752-4F0F-B918-B2C6A59A47B1}\RP38\A0010859.exe infected by "Trojan.Win32.Agent.bi" Virus! Action Taken: No Action Taken. File E:\System Volume Information\_restore{59467B53-1752-4F0F-B918-B2C6A59A47B1}\RP38\A0010861.exe infected by "Trojan.Win32.Agent.bi" Virus! Action Taken: No Action Taken. File E:\System Volume Information\_restore{59467B53-1752-4F0F-B918-B2C6A59A47B1}\RP40\A0010887.exe infected by "Trojan.Win32.Agent.bi" Virus! Action Taken: No Action Taken. File E:\System Volume Information\_restore{59467B53-1752-4F0F-B918-B2C6A59A47B1}\RP40\A0010898.exe infected by "Trojan.Win32.Agent.bi" Virus! Action Taken: No Action Taken. File E:\System Volume Information\_restore{59467B53-1752-4F0F-B918-B2C6A59A47B1}\RP40\A0010899.exe infected by "Trojan.Win32.Agent.bi" Virus! Action Taken: No Action Taken. File E:\System Volume Information\_restore{59467B53-1752-4F0F-B918-B2C6A59A47B1}\RP40\A0010915.dll infected by "Trojan-Downloader.Win32.Agent.jb" Virus! Action Taken: No Action Taken. File E:\System Volume Information\_restore{59467B53-1752-4F0F-B918-B2C6A59A47B1}\RP41\A0010954.exe infected by "Trojan.Win32.Agent.bi" Virus! Action Taken: No Action Taken. File E:\System Volume Information\_restore{59467B53-1752-4F0F-B918-B2C6A59A47B1}\RP41\A0010955.exe infected by "Trojan.Win32.Agent.bi" Virus! Action Taken: No Action Taken. File E:\System Volume Information\_restore{59467B53-1752-4F0F-B918-B2C6A59A47B1}\RP41\A0010956.exe infected by "Trojan.Win32.Agent.bi" Virus! Action Taken: No Action Taken. File E:\System Volume Information\_restore{59467B53-1752-4F0F-B918-B2C6A59A47B1}\RP41\A0010957.exe infected by "Trojan.Win32.Agent.bi" Virus! Action Taken: No Action Taken. File E:\System Volume Information\_restore{59467B53-1752-4F0F-B918-B2C6A59A47B1}\RP41\A0010958.exe infected by "Trojan.Win32.Agent.bi" Virus! Action Taken: No Action Taken. File E:\System Volume Information\_restore{59467B53-1752-4F0F-B918-B2C6A59A47B1}\RP41\A0010959.exe infected by "Trojan.Win32.Agent.bi" Virus! Action Taken: No Action Taken. File E:\System Volume Information\_restore{59467B53-1752-4F0F-B918-B2C6A59A47B1}\RP41\A0010960.exe infected by "Trojan.Win32.Agent.bi" Virus! Action Taken: No Action Taken. File E:\System Volume Information\_restore{59467B53-1752-4F0F-B918-B2C6A59A47B1}\RP41\A0010961.exe infected by "Trojan.Win32.Agent.bi" Virus! Action Taken: No Action Taken. File E:\System Volume Information\_restore{59467B53-1752-4F0F-B918-B2C6A59A47B1}\RP41\A0010962.exe infected by "Trojan.Win32.Agent.bi" Virus! Action Taken: No Action Taken. File E:\System Volume Information\_restore{59467B53-1752-4F0F-B918-B2C6A59A47B1}\RP41\A0010963.dll tagged as "not-a-virus:AdWare.SearchPage". Action Taken: No Action Taken. File E:\System Volume Information\_restore{59467B53-1752-4F0F-B918-B2C6A59A47B1}\RP41\A0010964.dll tagged as "not-a-virus:AdWare.SearchPage". Action Taken: No Action Taken. File E:\System Volume Information\_restore{59467B53-1752-4F0F-B918-B2C6A59A47B1}\RP41\A0010965.exe infected by "Trojan.Win32.Agent.bi" Virus! Action Taken: No Action Taken. File E:\System Volume Information\_restore{59467B53-1752-4F0F-B918-B2C6A59A47B1}\RP41\A0010966.exe infected by "Trojan.Win32.Agent.bi" Virus! Action Taken: No Action Taken. File E:\System Volume Information\_restore{59467B53-1752-4F0F-B918-B2C6A59A47B1}\RP41\A0010967.exe infected by "Trojan.Win32.Agent.bi" Virus! Action Taken: No Action Taken. File E:\System Volume Information\_restore{59467B53-1752-4F0F-B918-B2C6A59A47B1}\RP65\A0012521.exe tagged as not-a-virus:RiskWare.Monitor.Perflogger.a. No Action Taken. File E:\System Volume Information\_restore{59467B53-1752-4F0F-B918-B2C6A59A47B1}\RP65\A0012522.dll tagged as not-a-virus:RiskWare.Monitor.Perflogger.a. No Action Taken. File E:\System Volume Information\_restore{59467B53-1752-4F0F-B918-B2C6A59A47B1}\RP73\A0012983.exe infected by "Trojan.Win32.Delf.cf" Virus! Action Taken: No Action Taken. File E:\System Volume Information\_restore{59467B53-1752-4F0F-B918-B2C6A59A47B1}\RP75\A0012993.exe infected by "Trojan-Downloader.Win32.Delf.go" Virus! Action Taken: No Action Taken. File E:\System Volume Information\_restore{59467B53-1752-4F0F-B918-B2C6A59A47B1}\RP75\A0012995.dll infected by "Trojan-Downloader.Win32.Agent.jb" Virus! Action Taken: No Action Taken. File E:\System Volume Information\_restore{59467B53-1752-4F0F-B918-B2C6A59A47B1}\RP75\A0012996.dll infected by "Trojan-Downloader.Win32.Agent.jb" Virus! Action Taken: No Action Taken. File E:\System Volume Information\_restore{59467B53-1752-4F0F-B918-B2C6A59A47B1}\RP75\A0012997.dll infected by "Trojan-Downloader.Win32.Agent.jb" Virus! Action Taken: No Action Taken. File E:\System Volume Information\_restore{59467B53-1752-4F0F-B918-B2C6A59A47B1}\RP79\A0013084.exe infected by "Trojan.Win32.Delf.cf" Virus! Action Taken: No Action Taken. File E:\System Volume Information\_restore{59467B53-1752-4F0F-B918-B2C6A59A47B1}\RP89\A0013387.sys infected by "Trojan.Win32.Delf.cf" Virus! Action Taken: No Action Taken. File E:\System Volume Information\_restore{59467B53-1752-4F0F-B918-B2C6A59A47B1}\RP89\A0013388.exe infected by "Trojan.Win32.Delf.cf" Virus! Action Taken: No Action Taken. File E:\System Volume Information\_restore{59467B53-1752-4F0F-B918-B2C6A59A47B1}\RP89\A0013389.exe infected by "Trojan.Win32.Delf.cf" Virus! Action Taken: No Action Taken. File E:\System Volume Information\_restore{59467B53-1752-4F0F-B918-B2C6A59A47B1}\RP89\A0013390.sys infected by "Trojan.Win32.Delf.cf" Virus! Action Taken: No Action Taken. File E:\WINDOWS\fursdqpb.exe tagged as "not-a-virus:AdWare.BookedSpace.e". Action Taken: No Action Taken. File E:\WINDOWS\n8m.sys infected by "Trojan.Win32.Delf.cf" Virus! Action Taken: No Action Taken. File E:\WINDOWS\RegisteredPackages\{DD90D410-1823-43EB-9A16-A2331BF08799}$BACKUP$\System\wmplayer.exe tagged as "not-a-virus:AdWare.Pacer.c". Action Taken: No Action Taken. File E:\WINDOWS\system32\5rlicv.exe infected by "Trojan.Win32.Delf.cf" Virus! Action Taken: No Action Taken. File E:\WINDOWS\system32\bucq.dll infected by "Trojan.Win32.Delf.cf" Virus! Action Taken: No Action Taken. File E:\WINDOWS\system32\h9h.dll infected by "Trojan.Win32.Delf.cf" Virus! Action Taken: No Action Taken. File E:\WINDOWS\system32\n5v.exe infected by "Trojan.Win32.Delf.cf" Virus! Action Taken: No Action Taken. File E:\WINDOWS\system32\n8im7.exe infected by "Trojan.Win32.Delf.cf" Virus! Action Taken: No Action Taken. File E:\WINDOWS\system32\n8m.sys infected by "Trojan.Win32.Delf.cf" Virus! Action Taken: No Action Taken. File E:\WINDOWS\system32\ps1.exe tagged as "not-a-virus:AdWare.Pacer.h". Action Taken: No Action Taken. File E:\WINDOWS\system32\WSG32\procshow32.dll tagged as not-a-virus:RiskWare.Monitor.GoldenKeylogger.130. No Action Taken. File E:\WINDOWS\tool1.exe infected by "Trojan.Win32.LowZones.y" Virus! Action Taken: No Action Taken. File E:\WINDOWS\fursdqpb.exe tagged as "not-a-virus:AdWare.BookedSpace.e". Action Taken: No Action Taken. File E:\WINDOWS\n8m.sys infected by "Trojan.Win32.Delf.cf" Virus! Action Taken: No Action Taken. File E:\WINDOWS\RegisteredPackages\{DD90D410-1823-43EB-9A16-A2331BF08799}$BACKUP$\System\wmplayer.exe tagged as "not-a-virus:AdWare.Pacer.c". Action Taken: No Action Taken. File E:\WINDOWS\system32\5rlicv.exe infected by "Trojan.Win32.Delf.cf" Virus! Action Taken: No Action Taken. File E:\WINDOWS\system32\bucq.dll infected by "Trojan.Win32.Delf.cf" Virus! Action Taken: No Action Taken. File E:\WINDOWS\system32\h9h.dll infected by "Trojan.Win32.Delf.cf" Virus! Action Taken: No Action Taken. File E:\WINDOWS\system32\n5v.exe infected by "Trojan.Win32.Delf.cf" Virus! Action Taken: No Action Taken. File E:\WINDOWS\system32\n8im7.exe infected by "Trojan.Win32.Delf.cf" Virus! Action Taken: No Action Taken. File E:\WINDOWS\system32\n8m.sys infected by "Trojan.Win32.Delf.cf" Virus! Action Taken: No Action Taken. File E:\WINDOWS\system32\ps1.exe tagged as "not-a-virus:AdWare.Pacer.h". Action Taken: No Action Taken. File E:\WINDOWS\system32\WSG32\procshow32.dll tagged as not-a-virus:RiskWare.Monitor.GoldenKeylogger.130. No Action Taken. File E:\WINDOWS\tool1.exe infected by "Trojan.Win32.LowZones.y" Virus! Action Taken: No Action Taken.
Post #15
Download CCleabner from the link below >>>>>> http://www.majorgeeks.com/download4191.html

Dont open it yet.

Boot to safe mode then look for and delete these files.

File E:\WINDOWS\fursdqpb.exe
File E:\WINDOWS\n8m.sys
File E:\WINDOWS\system32\5rlicv.exe
File E:\WINDOWS\system32\bucq.dll
File E:\WINDOWS\system32\h9h.dll
File E:\WINDOWS\system32\n5v.exe
File E:\WINDOWS\system32\n8im7.exe
File E:\WINDOWS\system32\n8m.sys
File E:\WINDOWS\system32\ps1.exe
File E:\WINDOWS\system32\WSG32\procshow32.dll
File E:\WINDOWS\tool1.exe
File E:\WINDOWS\fursdqpb.exe
File E:\WINDOWS\n8m.sys
File E:\WINDOWS\system32\5rlicv.exe
File E:\WINDOWS\system32\bucq.dll
File E:\WINDOWS\system32\h9h.dll
File E:\WINDOWS\system32\n5v.exe
File E:\WINDOWS\system32\n8im7.exe
File E:\WINDOWS\system32\n8m.sys
File E:\WINDOWS\system32\ps1.exe
File E:\WINDOWS\system32\WSG32\procshow32.dll
File E:\WINDOWS\tool1.exe

Now open CCleanr and click on "run cleaner" at the bottom roht. Then reboot and post a new log please.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI