What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

PLEASE HELP!

5 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
im pretty sure i have HuntBar, VX2, n a couple of hijacks because my default browser homepage constantly changes to their desired page. i tried spybot, adware, microsoft adaware, etc , but they keep coming back, possibly reinstalling itself again n again, and no i cant find any programs in my add/remove in the control panel. So heres my current log. Your feedback would be greatly appreciated, thanx!



Logfile of HijackThis v1.99.1
Scan saved at 1:50:11 AM, on 06/06/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\Kazaa Lite K++\KazaaLite.kpp
C:\Program Files\Internet Explorer\iexplore.exe
I:\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;;
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O9 - Extra button: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\common\ylogin.dll
O9 - Extra 'Tools' menuitem: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\common\ylogin.dll
O9 - Extra button: Rogers Yahoo! Sidebar - {51085E3D-A958-42A2-A6BE-A6A9B0BAF276} - C:\Program Files\Yahoo!\browser\ysidebarIE.dll
O9 - Extra 'Tools' menuitem: Rogers &Yahoo! Sidebar - {51085E3D-A958-42A2-A6BE-A6A9B0BAF276} - C:\Program Files\Yahoo!\browser\ysidebarIE.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Ebates - {6685509E-B47B-4f47-8E16-9A5F3A62F683} - file://C:\Program Files\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.htm (file missing) (HKCU)
O9 - Extra button: @Home - {6A6F838E-1561-4FB0-8BD1-27C6C1C66C08} - http://home.excite.ca (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://home.excite.ca/
O16 - DPF: {11818680-FCF6-11D0-9808-0800092A4865} (FormFlow Form Control) - https://www.cbs.gov.on.ca/obra/forms/Codebase/FormCtl.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=34738&clcid=0x409
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst20040510.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200207…meInstaller.exe
O16 - DPF: {4AD7DA15-AB2F-4C91-BEF5-3876DA4A2CCC} - http://www.cambridgesoft.com/plugins/activ…/NetInstall.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/190b1c3b5316bb…ip/RdxIE601.cab
O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://download.zonelabs.com/bin/promotion…ctor/WebAAS.cab
O16 - DPF: {9BED3AC7-E6D4-43E7-B8A1-1FA502F639E1} (XTools Control) - http://player.bugs.co.kr/install/mv/XTools.cab
O16 - DPF: {AB29A544-D6B4-4E36-A1F8-D3E34FC7B00A} (WTHoster Class) - http://install.wildtangent.com/bgn/partner…bad/install.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {BF628973-1E86-4D0E-B42C-EDDECFFABDBC} (Bugs AoD Class) - http://player.bugs.co.kr/install/BugsLoader20041018.cab
O16 - DPF: {E13F1132-4CA0-4005-84D3-51406E27D269} (BTDownloadCtrl Control) - http://www.shockwave.com/content/thinktank…ownloadCtrl.cab
O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/_media/dalaillama/ampx.cab
O19 - User stylesheet: C:\WINDOWS\windows.dat
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe
O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\SYSTEM32\YPCSER~1.EXE
Post #2
Could you please go to Start - Run and type:
msconfig
Click OK.
Go to tab Startup, and click the button "Enable all"
Click Apply, then on Close.
Reboot, make a new HijackThis log, and post it here.
Post #3
k i did what you told me and heres my current log:

Logfile of HijackThis v1.99.1
Scan saved at 3:44:09 PM, on 06/06/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe
C:\WINDOWS\Explorer.exe
c:\windows\system32\llflanz.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
I:\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;;
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O9 - Extra button: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\common\ylogin.dll
O9 - Extra 'Tools' menuitem: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\common\ylogin.dll
O9 - Extra button: Rogers Yahoo! Sidebar - {51085E3D-A958-42A2-A6BE-A6A9B0BAF276} - C:\Program Files\Yahoo!\browser\ysidebarIE.dll
O9 - Extra 'Tools' menuitem: Rogers &Yahoo! Sidebar - {51085E3D-A958-42A2-A6BE-A6A9B0BAF276} - C:\Program Files\Yahoo!\browser\ysidebarIE.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Ebates - {6685509E-B47B-4f47-8E16-9A5F3A62F683} - file://C:\Program Files\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.htm (file missing) (HKCU)
O9 - Extra button: @Home - {6A6F838E-1561-4FB0-8BD1-27C6C1C66C08} - http://home.excite.ca (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://home.excite.ca/
O16 - DPF: {11818680-FCF6-11D0-9808-0800092A4865} (FormFlow Form Control) - https://www.cbs.gov.on.ca/obra/forms/Codebase/FormCtl.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=34738&clcid=0x409
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst20040510.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200207…meInstaller.exe
O16 - DPF: {4AD7DA15-AB2F-4C91-BEF5-3876DA4A2CCC} - http://www.cambridgesoft.com/plugins/activ…/NetInstall.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/190b1c3b5316bb…ip/RdxIE601.cab
O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://download.zonelabs.com/bin/promotion…ctor/WebAAS.cab
O16 - DPF: {9BED3AC7-E6D4-43E7-B8A1-1FA502F639E1} (XTools Control) - http://player.bugs.co.kr/install/mv/XTools.cab
O16 - DPF: {AB29A544-D6B4-4E36-A1F8-D3E34FC7B00A} (WTHoster Class) - http://install.wildtangent.com/bgn/partner…bad/install.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {BF628973-1E86-4D0E-B42C-EDDECFFABDBC} (Bugs AoD Class) - http://player.bugs.co.kr/install/BugsLoader20041018.cab
O16 - DPF: {E13F1132-4CA0-4005-84D3-51406E27D269} (BTDownloadCtrl Control) - http://www.shockwave.com/content/thinktank…ownloadCtrl.cab
O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/_media/dalaillama/ampx.cab
O19 - User stylesheet: C:\WINDOWS\windows.dat
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe
O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\SYSTEM32\YPCSER~1.EXE
Post #4
Sorry to bother u again, but whenever i run SpyBot: ABetterInternet, HotsearchBar and Possible hijacks always shows up, but whenever i try to fix them, they all seem to be fine except 1 file for the HotsearchBar which is: C:\WINDOWS\SYSTEM32\DrPMon.dll N plus everytime i scan my comp, same 3 problems always arises back again n again………
Post #5
So you don't have any startupitems? Have you fixed them with HijackThis? (the O4 lines)

Anyway…

Please download the trial version of Ewido Security Suite here:
http://www.ewido.net/en/download/
Install it, and update the definitions to the newest files. Do NOT run a scan yet.

Please download Nailfix from here:
http://www.noidea.us/easyfile/file.php?sho…050515010747824
Unzip it to the desktop but please do NOT run it yet.

The above Registry file written by miekiemoes, Swandog and racooper was written specifically for this infection and is not to be used on any other infection as it could damage a person's PC

Next, please reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Select the first option, to run Windows in Safe Mode.

For additional help in booting into Safe Mode, see the following site:
http://www.pchell.com/support/safemode.shtml

Once in Safe Mode, please double-click on Nailfix.bat. Your desktop and icons will disappear and reappear, and a window should open and close very quickly — this is normal.

Then please run Ewido, and run a full scan. Post the log from the scan here for me.

Then please run HijackThis, click Scan, and check (if there):

F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe

Close all open windows except for HijackThis and click Fix Checked.

Restart your computer in normal mode and please post a new HijackThis log, as well as the log from the Ewido scan.
Post #6
Alrite, i completed all the scans and here are the results:

for the Ewido Scan log:

———————————————————
ewido security suite - Scan report
———————————————————

+ Created on: 6:26:15 PM, 06/06/2005
+ Report-Checksum: 85AD9A02

+ Date of database: 06/06/2005
+ Version of scan engine: v3.0

+ Duration: 56 min
+ Scanned Files: 55957
+ Speed: 16.60 Files/Second
+ Infected files: 63
+ Removed files: 63
+ Files put in quarantine: 63
+ Files that could not be opened: 0
+ Files that could not be cleaned: 0

+ Binder: Yes
+ Crypter: Yes
+ Archives: Yes

+ Scanned items:
C:\
D:\
E:\

+ Scan result:
C:\WINDOWS\Nail.exe -> Trojan.Nail -> Cleaned with backup
C:\WINDOWS\exbjsnwex.exe -> Spyware.BetterInternet -> Cleaned with backup
C:\WINDOWS\XPsys.exe -> TrojanDownloader.Delf.ia -> Cleaned with backup
C:\WINDOWS\24660.exe -> Spyware.Delf.bk -> Cleaned with backup
C:\WINDOWS\yahoo22.exe -> Spyware.Delf.bk -> Cleaned with backup
C:\WINDOWS\56561.exe -> Spyware.Delf.bk -> Cleaned with backup
C:\0xf9.exe -> TrojanDownloader.Apher -> Cleaned with backup
C:\Program Files\Yahoo!\YPSR\Quarantine\ppq15.tmp -> Spyware.WebRebates -> Cleaned with backup
C:\Program Files\Baidu\bar\BaiduBar.dll -> Spyware.Baidu -> Cleaned with backup
C:\Documents and Settings\Jerry Liu\Local Settings\Temp\F.tmp\thnall1ac.exe -> Spyware.BetterInternet -> Cleaned with backup
C:\Documents and Settings\Jerry Liu\Local Settings\Temp\temp.fr2B81\WToolsA.exe -> Spyware.Wintol.y -> Cleaned with backup
C:\Documents and Settings\Jerry Liu\Local Settings\Temp\temp.fr76B5\common.dll -> Spyware.WebSearch.aj -> Cleaned with backup
C:\Documents and Settings\Jerry Liu\Local Settings\Temp\temp.fr319C -> Trojan.Agent.db -> Cleaned with backup
C:\System Volume Information\_restore{D1E84DCE-4330-44F9-8DFD-BAD1526E8034}\RP895\A0122226.exe -> Spyware.BetterInternet -> Cleaned with backup
C:\System Volume Information\_restore{D1E84DCE-4330-44F9-8DFD-BAD1526E8034}\RP895\A0122289.exe -> Spyware.BetterInternet -> Cleaned with backup
C:\System Volume Information\_restore{D1E84DCE-4330-44F9-8DFD-BAD1526E8034}\RP896\A0122345.exe -> Spyware.BetterInternet -> Cleaned with backup
C:\System Volume Information\_restore{D1E84DCE-4330-44F9-8DFD-BAD1526E8034}\RP897\A0122391.exe -> Spyware.Cometsystems -> Cleaned with backup
C:\System Volume Information\_restore{D1E84DCE-4330-44F9-8DFD-BAD1526E8034}\RP897\A0122595.exe -> Spyware.BetterInternet -> Cleaned with backup
C:\System Volume Information\_restore{D1E84DCE-4330-44F9-8DFD-BAD1526E8034}\RP897\A0122742.exe -> Spyware.BetterInternet -> Cleaned with backup
C:\System Volume Information\_restore{D1E84DCE-4330-44F9-8DFD-BAD1526E8034}\RP897\A0122745.exe -> Spyware.BetterInternet -> Cleaned with backup
C:\System Volume Information\_restore{D1E84DCE-4330-44F9-8DFD-BAD1526E8034}\RP897\A0122830.exe -> Spyware.Wintol.y -> Cleaned with backup
C:\System Volume Information\_restore{D1E84DCE-4330-44F9-8DFD-BAD1526E8034}\RP897\A0122848.exe -> Spyware.BetterInternet -> Cleaned with backup
C:\System Volume Information\_restore{D1E84DCE-4330-44F9-8DFD-BAD1526E8034}\RP898\A0122880.exe -> Spyware.BetterInternet -> Cleaned with backup
C:\System Volume Information\_restore{D1E84DCE-4330-44F9-8DFD-BAD1526E8034}\RP899\A0122931.exe -> Spyware.BetterInternet -> Cleaned with backup
C:\System Volume Information\_restore{D1E84DCE-4330-44F9-8DFD-BAD1526E8034}\RP901\A0122949.DLL -> Spyware.MyWay -> Cleaned with backup
C:\System Volume Information\_restore{D1E84DCE-4330-44F9-8DFD-BAD1526E8034}\RP901\A0122952.dll -> Spyware.WildTangent.b -> Cleaned with backup
C:\System Volume Information\_restore{D1E84DCE-4330-44F9-8DFD-BAD1526E8034}\RP901\A0122962.exe -> Spyware.Wintol.y -> Cleaned with backup
C:\System Volume Information\_restore{D1E84DCE-4330-44F9-8DFD-BAD1526E8034}\RP902\A0122972.exe -> Trojan.Nail -> Cleaned with backup
C:\System Volume Information\_restore{D1E84DCE-4330-44F9-8DFD-BAD1526E8034}\RP902\A0123120.exe -> Spyware.Wintol.y -> Cleaned with backup
C:\System Volume Information\_restore{D1E84DCE-4330-44F9-8DFD-BAD1526E8034}\RP902\A0123121.exe -> Spyware.BetterInternet -> Cleaned with backup
C:\System Volume Information\_restore{D1E84DCE-4330-44F9-8DFD-BAD1526E8034}\RP903\A0123122.exe -> Spyware.BetterInternet -> Cleaned with backup
C:\System Volume Information\_restore{D1E84DCE-4330-44F9-8DFD-BAD1526E8034}\RP903\A0123169.exe -> Spyware.Wintol.y -> Cleaned with backup
C:\System Volume Information\_restore{D1E84DCE-4330-44F9-8DFD-BAD1526E8034}\RP903\A0123228.exe -> Spyware.BetterInternet -> Cleaned with backup
C:\System Volume Information\_restore{D1E84DCE-4330-44F9-8DFD-BAD1526E8034}\RP903\A0123267.exe -> Spyware.Wintol.y -> Cleaned with backup
C:\System Volume Information\_restore{D1E84DCE-4330-44F9-8DFD-BAD1526E8034}\RP903\A0123270.exe -> TrojanDownloader.Dluca.a -> Cleaned with backup
C:\System Volume Information\_restore{D1E84DCE-4330-44F9-8DFD-BAD1526E8034}\RP904\snapshot\MFEX-85.DAT -> Spyware.Wintol.y -> Cleaned with backup
C:\System Volume Information\_restore{D1E84DCE-4330-44F9-8DFD-BAD1526E8034}\RP904\snapshot\MFEX-96.DAT -> Spyware.WebSearch.aj -> Cleaned with backup
C:\System Volume Information\_restore{D1E84DCE-4330-44F9-8DFD-BAD1526E8034}\RP904\A0123303.exe -> Spyware.Wintol.y -> Cleaned with backup
C:\System Volume Information\_restore{D1E84DCE-4330-44F9-8DFD-BAD1526E8034}\RP904\A0123305.DLL -> Spyware.WebSearch.aj -> Cleaned with backup
C:\System Volume Information\_restore{D1E84DCE-4330-44F9-8DFD-BAD1526E8034}\RP904\A0123321.exe -> Trojan.Nail -> Cleaned with backup
C:\System Volume Information\_restore{D1E84DCE-4330-44F9-8DFD-BAD1526E8034}\RP904\A0123322.exe -> Spyware.BetterInternet -> Cleaned with backup
C:\System Volume Information\_restore{D1E84DCE-4330-44F9-8DFD-BAD1526E8034}\RP905\A0123326.exe -> Spyware.BetterInternet -> Cleaned with backup
C:\System Volume Information\_restore{D1E84DCE-4330-44F9-8DFD-BAD1526E8034}\RP905\A0123503.exe -> Spyware.BetterInternet -> Cleaned with backup
C:\System Volume Information\_restore{D1E84DCE-4330-44F9-8DFD-BAD1526E8034}\RP905\A0123506.exe -> Trojan.Nail -> Cleaned with backup
C:\System Volume Information\_restore{D1E84DCE-4330-44F9-8DFD-BAD1526E8034}\RP905\A0123528.exe -> Spyware.BetterInternet -> Cleaned with backup
C:\System Volume Information\_restore{D1E84DCE-4330-44F9-8DFD-BAD1526E8034}\RP905\A0123597.exe -> Spyware.BetterInternet -> Cleaned with backup
C:\System Volume Information\_restore{D1E84DCE-4330-44F9-8DFD-BAD1526E8034}\RP913\A0128171.exe -> Trojan.Nail -> Cleaned with backup
C:\System Volume Information\_restore{D1E84DCE-4330-44F9-8DFD-BAD1526E8034}\RP913\A0128312.exe -> Trojan.Nail -> Cleaned with backup
C:\System Volume Information\_restore{D1E84DCE-4330-44F9-8DFD-BAD1526E8034}\RP917\A0128583.exe -> Trojan.Nail -> Cleaned with backup
C:\System Volume Information\_restore{D1E84DCE-4330-44F9-8DFD-BAD1526E8034}\RP917\A0128601.hta -> TrojanDropper.Inor.cj -> Cleaned with backup
C:\System Volume Information\_restore{D1E84DCE-4330-44F9-8DFD-BAD1526E8034}\RP917\A0128602.exe -> Trojan.Agent.cp -> Cleaned with backup
C:\System Volume Information\_restore{D1E84DCE-4330-44F9-8DFD-BAD1526E8034}\RP917\A0128603.dll -> Spyware.ToolBar.Alibabar -> Cleaned with backup
C:\System Volume Information\_restore{D1E84DCE-4330-44F9-8DFD-BAD1526E8034}\RP890\A0121846.dll -> Spyware.DlMax.a -> Cleaned with backup
C:\System Volume Information\_restore{D1E84DCE-4330-44F9-8DFD-BAD1526E8034}\RP891\A0121898.exe -> Trojan.Nail -> Cleaned with backup
C:\System Volume Information\_restore{D1E84DCE-4330-44F9-8DFD-BAD1526E8034}\RP891\A0121935.exe -> Spyware.BetterInternet -> Cleaned with backup
C:\System Volume Information\_restore{D1E84DCE-4330-44F9-8DFD-BAD1526E8034}\RP892\A0122041.exe -> Spyware.BetterInternet -> Cleaned with backup
C:\System Volume Information\_restore{D1E84DCE-4330-44F9-8DFD-BAD1526E8034}\RP893\A0122138.exe -> Spyware.BetterInternet -> Cleaned with backup
C:\System Volume Information\_restore{D1E84DCE-4330-44F9-8DFD-BAD1526E8034}\RP907\A0123686.exe -> Trojan.Nail -> Cleaned with backup
C:\System Volume Information\_restore{D1E84DCE-4330-44F9-8DFD-BAD1526E8034}\RP907\A0123723.exe -> TrojanDownloader.Delf.ia -> Cleaned with backup
C:\System Volume Information\_restore{D1E84DCE-4330-44F9-8DFD-BAD1526E8034}\RP907\A0123724.exe -> Spyware.Delf.bk -> Cleaned with backup
C:\System Volume Information\_restore{D1E84DCE-4330-44F9-8DFD-BAD1526E8034}\RP907\A0123726.exe -> TrojanDownloader.Delf.ia -> Cleaned with backup
C:\System Volume Information\_restore{D1E84DCE-4330-44F9-8DFD-BAD1526E8034}\RP909\A0126011.dll -> Spyware.ToolBar.Alibabar -> Cleaned with backup
C:\System Volume Information\_restore{D1E84DCE-4330-44F9-8DFD-BAD1526E8034}\RP909\A0126022.vxd -> Spyware.MediaPass -> Cleaned with backup


::Report End






And this is my current Hijackthis log, apparently i can't find the F2- REG:system.ini: Shell=Exlorer.exe C:\WINDOWS\Nail.exe (probably fixed)


Logfile of HijackThis v1.99.1
Scan saved at 6:29:50 PM, on 06/06/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\explorer.exe
I:\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;;
O9 - Extra button: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\common\ylogin.dll
O9 - Extra 'Tools' menuitem: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\common\ylogin.dll
O9 - Extra button: Rogers Yahoo! Sidebar - {51085E3D-A958-42A2-A6BE-A6A9B0BAF276} - C:\Program Files\Yahoo!\browser\ysidebarIE.dll
O9 - Extra 'Tools' menuitem: Rogers &Yahoo! Sidebar - {51085E3D-A958-42A2-A6BE-A6A9B0BAF276} - C:\Program Files\Yahoo!\browser\ysidebarIE.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Ebates - {6685509E-B47B-4f47-8E16-9A5F3A62F683} - file://C:\Program Files\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.htm (file missing) (HKCU)
O9 - Extra button: @Home - {6A6F838E-1561-4FB0-8BD1-27C6C1C66C08} - http://home.excite.ca (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://home.excite.ca/
O16 - DPF: {11818680-FCF6-11D0-9808-0800092A4865} (FormFlow Form Control) - https://www.cbs.gov.on.ca/obra/forms/Codebase/FormCtl.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=34738&clcid=0x409
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst20040510.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200207…meInstaller.exe
O16 - DPF: {4AD7DA15-AB2F-4C91-BEF5-3876DA4A2CCC} - http://www.cambridgesoft.com/plugins/activ…/NetInstall.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/190b1c3b5316bb…ip/RdxIE601.cab
O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://download.zonelabs.com/bin/promotion…ctor/WebAAS.cab
O16 - DPF: {9BED3AC7-E6D4-43E7-B8A1-1FA502F639E1} (XTools Control) - http://player.bugs.co.kr/install/mv/XTools.cab
O16 - DPF: {AB29A544-D6B4-4E36-A1F8-D3E34FC7B00A} (WTHoster Class) - http://install.wildtangent.com/bgn/partner…bad/install.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {BF628973-1E86-4D0E-B42C-EDDECFFABDBC} (Bugs AoD Class) - http://player.bugs.co.kr/install/BugsLoader20041018.cab
O16 - DPF: {E13F1132-4CA0-4005-84D3-51406E27D269} (BTDownloadCtrl Control) - http://www.shockwave.com/content/thinktank…ownloadCtrl.cab
O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/_media/dalaillama/ampx.cab
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe
O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\SYSTEM32\YPCSER~1.EXE



Btw, Ewido is an excellent program, but im not quite sure if it fixed everything because my homepage still has issues, cant seem to convert it to my desired page such as yahoo.com or wutever. Your feedback would be greatly appreciated, Thank you!
Post #7
1. Run HijackThis (“Do a system scan only”). Put a checkmark near these lines:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

O9 - Extra button: Ebates - {6685509E-B47B-4f47-8E16-9A5F3A62F683} - file://C:\Program Files\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.htm (file missing) (HKCU)

O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/190b1c3b5316bb…ip/RdxIE601.cab


2. Close all other windows and browsers, and hit Fix Checked.

3. Reboot into safe mode by tapping F8 frequently during bootup.
Make sure your settings allow you to view "Hidden files". Open up any explorer windows and click on "Tools" => "Folder Options" => "View" and be sure to check off "Show Hidden Files and Folders".

4. Delete, in safe mode:
C:\Program Files\Ebates_MoeMoneyMaker << folder

5. Reboot into normal mode, make a new HijackThis log, and post it here :)
Post #8
k thanx for ur reply, here's my current log:



Logfile of HijackThis v1.99.1
Scan saved at 9:45:04 PM, on 07/06/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
I:\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;;
O9 - Extra button: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\common\ylogin.dll
O9 - Extra 'Tools' menuitem: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\common\ylogin.dll
O9 - Extra button: Rogers Yahoo! Sidebar - {51085E3D-A958-42A2-A6BE-A6A9B0BAF276} - C:\Program Files\Yahoo!\browser\ysidebarIE.dll
O9 - Extra 'Tools' menuitem: Rogers &Yahoo! Sidebar - {51085E3D-A958-42A2-A6BE-A6A9B0BAF276} - C:\Program Files\Yahoo!\browser\ysidebarIE.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: @Home - {6A6F838E-1561-4FB0-8BD1-27C6C1C66C08} - http://home.excite.ca (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://home.excite.ca/
O16 - DPF: {11818680-FCF6-11D0-9808-0800092A4865} (FormFlow Form Control) - https://www.cbs.gov.on.ca/obra/forms/Codebase/FormCtl.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=34738&clcid=0x409
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst20040510.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200207…meInstaller.exe
O16 - DPF: {4AD7DA15-AB2F-4C91-BEF5-3876DA4A2CCC} - http://www.cambridgesoft.com/plugins/activ…/NetInstall.cab
O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://download.zonelabs.com/bin/promotion…ctor/WebAAS.cab
O16 - DPF: {9BED3AC7-E6D4-43E7-B8A1-1FA502F639E1} (XTools Control) - http://player.bugs.co.kr/install/mv/XTools.cab
O16 - DPF: {AB29A544-D6B4-4E36-A1F8-D3E34FC7B00A} (WTHoster Class) - http://install.wildtangent.com/bgn/partner…bad/install.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {BF628973-1E86-4D0E-B42C-EDDECFFABDBC} (Bugs AoD Class) - http://player.bugs.co.kr/install/BugsLoader20041018.cab
O16 - DPF: {E13F1132-4CA0-4005-84D3-51406E27D269} (BTDownloadCtrl Control) - http://www.shockwave.com/content/thinktank…ownloadCtrl.cab
O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/_media/dalaillama/ampx.cab
O19 - User stylesheet: C:\WINDOWS\windows.dat
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe
O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\SYSTEM32\YPCSER~1.EXE



Btw, i couldn't find any Ebates MoeMoneyMaker folder in my program files (yes i did show hidden files). Maybe the hijackthis deleted it, but not quite sure?
As for my IE, there's STILL the issue of my homepage. Maybe this time i should run spybot, adaware etc software again to resolve this issue? Your feedback would be greatly appreciated, thanx again!
Post #9
Anyways i will be replacing my current computer with a new computer in a few days so dont stress yourself too much about this problem. It's been hell these couple of days just trying to maintain a healthy and stable PC, but i doubt i will be connecting my current comp on the net.
Post #10
ahh sorry i accidently cut short my msg, but anywaz if u can resolve this issue, i would greatly appreciate it so that i may use this as a reference in the future, and if not, its kool. As for programs to protect future potential threats on my new comp, i will definetly install: Spybot, Adware SE, Microsoft antispyware, ewido, norton antivirus, spyblaster and of course hijackthis (please feel free to make any other suggestions). Thank you soo much for sacrificing your time and effort. Keep up the good work! :)
Post #12
alrite here it is:

Logfile of HijackThis v1.99.1
Scan saved at 5:07:44 PM, on 08/06/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
I:\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;;
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O9 - Extra button: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\common\ylogin.dll
O9 - Extra 'Tools' menuitem: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\common\ylogin.dll
O9 - Extra button: Rogers Yahoo! Sidebar - {51085E3D-A958-42A2-A6BE-A6A9B0BAF276} - C:\Program Files\Yahoo!\browser\ysidebarIE.dll
O9 - Extra 'Tools' menuitem: Rogers &Yahoo! Sidebar - {51085E3D-A958-42A2-A6BE-A6A9B0BAF276} - C:\Program Files\Yahoo!\browser\ysidebarIE.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: @Home - {6A6F838E-1561-4FB0-8BD1-27C6C1C66C08} - http://home.excite.ca (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://home.excite.ca/
O16 - DPF: {11818680-FCF6-11D0-9808-0800092A4865} (FormFlow Form Control) - https://www.cbs.gov.on.ca/obra/forms/Codebase/FormCtl.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=34738&clcid=0x409
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst20040510.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200207…meInstaller.exe
O16 - DPF: {4AD7DA15-AB2F-4C91-BEF5-3876DA4A2CCC} - http://www.cambridgesoft.com/plugins/activ…/NetInstall.cab
O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://download.zonelabs.com/bin/promotion…ctor/WebAAS.cab
O16 - DPF: {9BED3AC7-E6D4-43E7-B8A1-1FA502F639E1} (XTools Control) - http://player.bugs.co.kr/install/mv/XTools.cab
O16 - DPF: {AB29A544-D6B4-4E36-A1F8-D3E34FC7B00A} (WTHoster Class) - http://install.wildtangent.com/bgn/partner…bad/install.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {BF628973-1E86-4D0E-B42C-EDDECFFABDBC} (Bugs AoD Class) - http://player.bugs.co.kr/install/BugsLoader20041018.cab
O16 - DPF: {E13F1132-4CA0-4005-84D3-51406E27D269} (BTDownloadCtrl Control) - http://www.shockwave.com/content/thinktank…ownloadCtrl.cab
O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/_media/dalaillama/ampx.cab
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe
O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\SYSTEM32\YPCSER~1.EXE
Post #15
Great to hear! :)

Here are some tips, to reduce the potential for spyware infection in the future, I strongly recommend installing the following applications:
  • Spywareblaster <= SpywareBlaster will prevent spyware from being installed.
  • Spywareguard <= SpywareGuard offers real-time protection from spyware installation attempts.
  • How to use Ad-Aware to remove Spyware <= If you suspect that you have spyware installed on your computer, here are instructions on how to download, install and then use Ad-Aware.
  • How to use Spybot to remove Spyware <= If you suspect that you have spyware installed on your computer, here are instructions on how to download, install and then use Spybot. Similar to Ad-Aware, I strongly recommend both to catch most spyware.
To protect yourself further:
  • IE/Spyad <= IE/Spyad places over 4000 websites and domains in the IE Restricted list which will severely impair attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites.
  • MVPS Hosts file <= The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer
I also suggest that you delete your Temp folders regularly. Use CleanUp! to do this automatically for you!

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI