What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Annoying Pop ups,Bloodhound.32.EP & MediaAccK.exe

27 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #31 last edited
As I wake up toady morning I see my Windows was shutdown with a following message on black background screen:

A problem has been detected and windows has been shut down to prevent damage to your computer.
If this is the first time you have seen this stop screen,restart your computer.if this screen appears again,follow these steps.
Check to be sure you have adequate disck space.If a driver is identified in the stop message,disable the driver or check with manufacturer for driver upadtes.Try changing video adapters.
Check with your harware vendor for any BIOS upadtes.Disable BIOS memory options such as caching or shadowing.If you need to use the safe mode to remove or disable components,press F8 to select adavnce startup options,and then select safe mode.
Technical Information:
***STOP:0x0000008E(0x0000005,0xBF802F96,0xF29EFC14,0x00000000)
***win32k.Sys-Address BF802F96 base at BF800000,Date Stamp 00000000
   Beginning Dump of Physical Memory


Please note that after that I run AOL Spyware in Safe Mode which did not show anything,later as a preventive step,I shutdown to take out an additional AZEN RAM PC133-128MB from slot#1 which was defunct inside there for few days to check possibility of increasing RAM.I left original INTEL specified Kingston RAM in slot#0.
Further note that yesterday and last night I kept trying to add Sympatico E-mail in Outlook Express which is running very well for our 2 hotmail addresses.
I kept Outlook Express in Permit All Configuartion of Nortron Antivirus.
I think I must run HJT and will post log for your kind tech review and suggestions.
Post #32
Logfile of HijackThis v1.99.1
Scan saved at 1:11:04 PM, on 7/1/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Common Files\Real\Update_OB\realsched.exe
D:\WINDOWS\system32\wfxsnt40.exe
D:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
D:\Program Files\MSN

Apps\Updater\01.02.3000.1001\en-us\msnappau.exe
D:\Program Files\QuickTime\qttask.exe
D:\WINDOWS\System32\igfxtray.exe
D:\WINDOWS\System32\hkcmd.exe
D:\PROGRA~1\COMMON~1\AOL\ACS\AOLACSD.EXE
D:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe
D:\Program Files\Norton Internet Security\IAMAPP.EXE
D:\PROGRA~1\NORTON~2\navapw32.exe
D:\WINDOWS\system32\rkmpkk.exe
D:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
D:\Program Files\Adobe\Acrobat 7.0\Distillr\AcroDist.exe
D:\Program Files\hotfoon4.exe
D:\Program Files\ewido\security suite\ewidoctrl.exe
D:\Program Files\AOL Companion\companion.exe
D:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\WinZip\WZQKPICK.EXE
D:\Program Files\Norton Antivirus\navapsvc.exe
D:\Program Files\Norton Internet Security\NISUM.EXE
D:\WINDOWS\System32\svchost.exe
D:\Program Files\Norton Internet Security\SymProxySvc.exe
D:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
D:\WINDOWS\system32\WFXSVC.EXE
D:\Program Files\Norton Internet Security\NISSERV.EXE
D:\Program Files\Symantec\WinFax\WFXMOD32.EXE
D:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Adobelm_Cleanup.0001
D:\Program Files\Common Files\Adobe Systems

Shared\Service\Adobelmsvc.exe
D:\WINDOWS\system32\wscntfy.exe
D:\COMPROB\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start

Page =

http://groups-beta.google.com/group/24hoursupport.helpdesk
O2 - BHO: Google Toolbar Helper -

{AA58ED58-01DD-4d91-8333-CF10577473F7} - d:\program

files\google\googletoolbar1.dll
O2 - BHO: NAV Helper -

{BDF3E430-B101-42AD-A544-FADC6B084872} - D:\Program

Files\Norton Antivirus\NavShExt.dll
O3 - Toolbar: &Google -

{2318C2B1-4965-11d4-9B18-009027A5CD4F} - d:\program

files\google\googletoolbar1.dll
O3 - Toolbar: Norton AntiVirus -

{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - D:\Program

Files\Norton Antivirus\NavShExt.dll
O4 - HKLM\..\Run: [TkBellExe] "D:\Program Files\Common

Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [WinFaxAppPortStarter] wfxsnt40.exe
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "D:\Program

Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [msnappau] "D:\Program Files\MSN

Apps\Updater\01.02.3000.1001\en-us\msnappau.exe"
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program

Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Symantec NetDriver Monitor]

D:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [IgfxTray]

D:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds]

D:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [DownloadAccelerator]

D:\PROGRA~1\DAP\DAP.EXE /STARTUP
O4 - HKLM\..\Run: [CallControl 4.5] D:\Program

Files\FaxTalk Communicator\FTCtrl32.exe /autoload
O4 - HKLM\..\Run: [AOL Spyware Protection]

"D:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKLM\..\Run: [iamapp] D:\Program Files\Norton

Internet Security\IAMAPP.EXE
O4 - HKLM\..\Run: [NAV Agent]

D:\PROGRA~1\NORTON~2\navapw32.exe
O4 - HKLM\..\Run: [KavSvc] D:\WINDOWS\system32\rkmpkk.exe

reg_run
O4 - HKLM\..\Run: [SunJavaUpdateSched] D:\Program

Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [KernelFaultCheck]

%systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [msnmsgr] "D:\Program Files\MSN

Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] D:\Program

Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [Babylon Translator] D:\Program

Files\Babylon\Babylon.exe
O4 - HKCU\..\Run: [HOTFOON2] D:\Program Files\hotfoon4.exe

/h
O4 - Global Startup: AOL Companion.lnk = D:\Program

Files\AOL Companion\companion.exe
O4 - Global Startup: AOL 9.0 Tray Icon.lnk = D:\Program

Files\AOL 9.0a\aoltray.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program

Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Google Search -

res://D:\Program

Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word -

res://D:\Program

Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links -

res://D:\Program

Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page -

res://D:\Program

Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Convert link target to Adobe

PDF - res://D:\Program Files\Adobe\Acrobat

7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to

existing PDF - res://D:\Program Files\Adobe\Acrobat

7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to

Adobe PDF - res://D:\Program Files\Adobe\Acrobat

7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to

existing PDF - res://D:\Program Files\Adobe\Acrobat

7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe

PDF - res://D:\Program Files\Adobe\Acrobat

7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to

existing PDF - res://D:\Program Files\Adobe\Acrobat

7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF -

res://D:\Program Files\Adobe\Acrobat

7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF -

res://D:\Program Files\Adobe\Acrobat

7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel -

res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages -

res://D:\Program

Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English

- res://D:\Program

Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) -

{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program

Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console -

{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program

Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Messenger -

{4528BBE0-4E08-11D5-AD55-00010333D0AD} - D:\Program

Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger -

{4528BBE0-4E08-11D5-AD55-00010333D0AD} - D:\Program

Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: AOL Toolbar -

{4982D40A-C53B-4615-B15B-B5B5E98D167C} - D:\Program

Files\AOL Toolbar\toolbar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar -

{4982D40A-C53B-4615-B15B-B5B5E98D167C} - D:\Program

Files\AOL Toolbar\toolbar.dll
O9 - Extra button: Research -

{92780B25-18CC-41C8-B9BE-3C9C571A8263} -

D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Share in Hello -

{B13B4423-2647-4cfc-A4B3-C7D56CB83487} - D:\Program

Files\Hello\PicasaCapture.dll
O9 - Extra 'Tools' menuitem: Share in H&ello -

{B13B4423-2647-4cfc-A4B3-C7D56CB83487} - D:\Program

Files\Hello\PicasaCapture.dll
O9 - Extra button: Messenger -

{FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program

Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger -

{FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program

Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: D:\Program Files\Internet

Explorer\Plugins\NPDocBox.dll
O20 - Winlogon Notify: igfxcui -

D:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Adobe LM Service - Adobe Systems -

D:\Program Files\Common Files\Adobe Systems

Shared\Service\Adobelmsvc.exe
O23 - Service: AOL Connectivity Service (AOL ACS) -

America Online, Inc. -

D:\PROGRA~1\COMMON~1\AOL\ACS\AOLACSD.EXE
O23 - Service: AOL Spyware Protection Service (AOLService)

- Unknown owner -

D:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\\aolserv.exe
O23 - Service: ewido security suite control - ewido

networks - D:\Program Files\ewido\security

suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks

- D:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: Norton AntiVirus Auto Protect Service

(navapsvc) - Symantec Corporation - D:\Program

Files\Norton Antivirus\navapsvc.exe
O23 - Service: Norton Internet Security Service (NISSERV)

- Symantec Corporation - D:\Program Files\Norton Internet

Security\NISSERV.EXE
O23 - Service: Norton Internet Security Accounts Manager

(NISUM) - Symantec Corporation - D:\Program Files\Norton

Internet Security\NISUM.EXE
O23 - Service: ScriptBlocking Service (SBService) -

Symantec Corporation -

D:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc)

- Symantec Corporation - D:\Program Files\Common

Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Norton Internet Security Proxy Service

(SymProxySvc) - Symantec Corporation - D:\Program

Files\Norton Internet Security\SymProxySvc.exe
O23 - Service: WinFax PRO (wfxsvc) - Symantec Corporation

- D:\WINDOWS\system32\WFXSVC.EXE
Post #33
Host Name: FIZZAHFA-GRJTXU OS Name: Microsoft Windows XP Professional OS Version: 5.1.2600 Service Pack 2 Build 2600 OS Manufacturer: Microsoft Corporation OS Configuration: Standalone Workstation OS Build Type: Uniprocessor Free Registered Owner: FizzahFatin Registered Organization: Product ID: 55274-649-6478953-23664 Original Install Date: 10/31/2004, 11:08:05 PM System Up Time: 0 Days, 1 Hours, 44 Minutes, 21 Seconds System Manufacturer: INTEL_ System Model: D845GLLY System type: X86-based PC Processor(s): 1 Processor(s) Installed. [01]: x86 Family 15 Model 1 Stepping 3 GenuineIntel ~1800 Mhz BIOS Version: INTEL - 12000212 Windows Directory: D:\WINDOWS System Directory: D:\WINDOWS\system32 Boot Device: \Device\HarddiskVolume1 System Locale: en-us;English (United States) Input Locale: en-us;English (United States) Time Zone: (GMT-05:00) Eastern Time (US & Canada) Total Physical Memory: 126 MB Available Physical Memory: 25 MB Virtual Memory: Max Size: 2,048 MB Virtual Memory: Available: 2,002 MB Virtual Memory: In Use: 46 MB Page File Location(s): C:\pagefile.sys D:\pagefile.sys Domain: MSHOME Logon Server: \\FIZZAHFA-GRJTXU Hotfix(s): 49 Hotfix(s) Installed. [01]: File 1 [02]: File 1 [03]: File 1 [04]: File 1 [05]: File 1 [06]: File 1 [07]: File 1 [08]: File 1 [09]: File 1 [10]: File 1 [11]: File 1 [12]: File 1 [13]: File 1 [14]: File 1 [15]: File 1 [16]: File 1 [17]: File 1 [18]: File 1 [19]: File 1 [20]: File 1 [21]: File 1 [22]: File 1 [23]: File 1 [24]: Q147222 [25]: KB834707-IE6SP1-20040929.091901 - Update [26]: KB811113 - Service Pack [27]: KB834707 - Update [28]: KB873333 - Update [29]: KB873339 - Update [30]: KB883939 - Update [31]: KB885250 - Update [32]: KB885835 - Update [33]: KB885836 - Update [34]: KB886185 - Update [35]: KB887472 - Update [36]: KB887742 - Update [37]: KB888113 - Update [38]: KB888302 - Update [39]: KB890046 - Update [40]: KB890175 - Update [41]: KB890859 - Update [42]: KB891781 - Update [43]: KB893066 - Update [44]: KB893086 - Update [45]: KB893803v2 - Update [46]: KB896358 - Update [47]: KB896422 - Update [48]: KB896428 - Update [49]: KB898461 - Update NetWork Card(s): 1 NIC(s) Installed. [01]: Speedstream Ethernet USB Adapter Connection Name: Local Area Connection 6 DHCP Enabled: Yes DHCP Server: 192.168.2.1 IP address(es) [01]: 192.168.2.10
Post #34
Any luck on running RkFiles as requested above?

You only have one infection left, but I need to see the log from RkFiles to find the files to remove.

Once this is done, you can post in the Other Computer Problems forum for help in fixing the other issues.
Post #35
This is saved today,Jul07/05.

C:\unzipped\rkfiles

PLEASE NOTE THAT ALL FILES FOUND BY THIS METHOD ARE NOT BAD FILES, THERE MIGHT BE LEGIT FILES LISTED AND PLEASE BE CAREFUL WHILE FIXING. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.
Files Found in system Folder…………
————————
D:\WINDOWS\system32\dfrg.msc: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAwGpEc213

Files Found in all users startup Folder…………
————————
Files Found in all users windows Folder…………
————————
D:\WINDOWS\epsuninst.exe: UPX!
Finished
bye

Another old record saved on Jul02/05.

C:\unzipped\rkfiles

PLEASE NOTE THAT ALL FILES FOUND BY THIS METHOD ARE NOT BAD FILES, THERE MIGHT BE LEGIT FILES LISTED AND PLEASE BE CAREFUL WHILE FIXING. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.
Files Found in system Folder…………
————————
D:\WINDOWS\system32\dfrg.msc: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAwGpEc213

Files Found in all users startup Folder…………
————————
Files Found in all users windows Folder…………
————————
D:\WINDOWS\epsuninst.exe: UPX!
Finished
bye
Post #36
Unfortunately that didn't show what I was hoping it would. This must be the newest version of the Narrator trojan.
Please run the online Antivirus scan from Pandasoftware and save the log. Post that log and a fresh HijackThis log as a reply to this thread.
Post #37
I have installed and unistalled Acrobat7,which was not opening as I have downloaded it 2nd tryout,this time from my ENOX MP3CD,I think later after uninstalling I get popup/Spyware sitting in my Computer.This I get to know while opening workopolis link from OE6,instead it opened Navisearch.net.When I checked Add/Remove I see Exactadverising.com sponsored this navisearch.net without my permission,moreover Bullseyenetwork was also sitting there,I kicked hard both of them and removed them.
Later I run HJT,need your advise pls and thanks a lot to your kind efforts to a helpless man.
Logfile of HijackThis v1.99.1
Scan saved at 12:03:04 AM, on 7/8/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\system32\spoolsv.exe
D:\PROGRA~1\COMMON~1\AOL\ACS\AOLACSD.EXE
D:\Program Files\ewido\security suite\ewidoctrl.exe
D:\Program Files\Norton Antivirus\navapsvc.exe
D:\PROGRA~1\NORTON~2\navapw32.exe
D:\Program Files\Norton Internet Security\IAMAPP.EXE
D:\Program Files\Common Files\Real\Update_OB\realsched.exe
D:\Program Files\Norton Internet Security\NISUM.EXE
D:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\hotfoon4.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\Norton Internet Security\SymProxySvc.exe
D:\WINDOWS\system32\WFXSVC.EXE
D:\Program Files\Norton Internet Security\NISSERV.EXE
D:\Program Files\Symantec\WinFax\WFXMOD32.EXE
D:\WINDOWS\system32\wscntfy.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\WISPTIS.EXE
D:\COMPROB\HijackThis.exe
D:\WINDOWS\system32\rkmpkk.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://groups-beta.google.com/group/24hoursupport.helpdesk
O2 - BHO: CExtension Object - {0019C3E2-DD48-4A6D-ABCD-8D32436323D9} - D:\WINDOWS\cfgmgr52.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - d:\program files\google\googletoolbar1.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - D:\Program Files\Norton Antivirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - d:\program files\google\googletoolbar1.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - D:\Program Files\Norton Antivirus\NavShExt.dll
O4 - HKLM\..\Run: [NAV Agent] D:\PROGRA~1\NORTON~2\navapw32.exe
O4 - HKLM\..\Run: [iamapp] D:\Program Files\Norton Internet Security\IAMAPP.EXE
O4 - HKLM\..\Run: [TkBellExe] "D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [cfgmgr52] RunDLL32.EXE D:\WINDOWS\cfgmgr52.dll,DllRun
O4 - HKCU\..\Run: [msnmsgr] "D:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [HOTFOON2] C:\Program Files\hotfoon4.exe /h
O4 - Global Startup: ndti.exe
O8 - Extra context menu item: &Google Search - res://D:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://D:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://D:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://D:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://D:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://D:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - D:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - D:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - D:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - D:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Share in Hello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - D:\Program Files\Hello\PicasaCapture.dll
O9 - Extra 'Tools' menuitem: Share in H&ello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - D:\Program Files\Hello\PicasaCapture.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O20 - Winlogon Notify: igfxcui - D:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Adobe LM Service - Adobe Systems - D:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - D:\PROGRA~1\COMMON~1\AOL\ACS\AOLACSD.EXE
O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - D:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\\aolserv.exe
O23 - Service: ewido security suite control - ewido networks - D:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - D:\Program Files\Norton Antivirus\navapsvc.exe
O23 - Service: Norton Internet Security Service (NISSERV) - Symantec Corporation - D:\Program Files\Norton Internet Security\NISSERV.EXE
O23 - Service: Norton Internet Security Accounts Manager (NISUM) - Symantec Corporation - D:\Program Files\Norton Internet Security\NISUM.EXE
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - D:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Norton Internet Security Proxy Service (SymProxySvc) - Symantec Corporation - D:\Program Files\Norton Internet Security\SymProxySvc.exe
O23 - Service: WinFax PRO (wfxsvc) - Symantec Corporation - D:\WINDOWS\system32\WFXSVC.EXE
Post #38
Step 1
Open HijackThis, run a scan, then check the following:

O2 - BHO: CExtension Object - {0019C3E2-DD48-4A6D-ABCD-8D32436323D9} - D:\WINDOWS\cfgmgr52.dll
O4 - HKLM\..\Run: [cfgmgr52] RunDLL32.EXE D:\WINDOWS\cfgmgr52.dll,DllRun
O4 - Global Startup: ndti.exe

With all other programs and browsers closed, click fix checked.


Step 2
Double-click on Killbox.exe to start the program.
In the killbox program, select the Delete on Reboot option.
In the field labeled Full Path of File to Delete enter the file paths listed below ONE AT A TIME (EXACTLY as it appears, please double check to make sure!):

D:\WINDOWS\cfgmgr52.dll
D:\WINDOWS\system32\rkmpkk.exe
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ndti.exe

Press the button that looks like a red circle with a white X in it after each one. When it asks if you would like to delete on reboot, press the YES button, when it asks if you want to reboot now, press the NO button. Do this after each one until you have entered the LAST file path I have listed above. After that LAST file path has been entered, press the YES button at both prompts so that your computer restarts.
If you get a "PendingFileRenameOperations Registry Data has been Removed by External Process!" message then just restart manually.


Step 3
Run the Panda ActiveScan as instructed in the previous instructions and save the log.


Step 4
Reboot normally and scan with HijackThis. Post the new log as a reply to this thread. Include the Panda log.
Please let us know of any complications you had and how the computer is behaving.
Post #39
Logfile of HijackThis v1.99.1
Scan saved at 8:55:33 PM, on 7/8/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\Explorer.EXE
D:\PROGRA~1\COMMON~1\AOL\ACS\AOLACSD.EXE
D:\Program Files\ewido\security suite\ewidoctrl.exe
D:\Program Files\Norton Antivirus\navapsvc.exe
D:\Program Files\Norton Internet Security\NISUM.EXE
D:\WINDOWS\System32\svchost.exe
D:\Program Files\Norton Internet Security\SymProxySvc.exe
D:\WINDOWS\system32\WFXSVC.EXE
D:\Program Files\Norton Internet Security\NISSERV.EXE
D:\Program Files\Symantec\WinFax\WFXMOD32.EXE
D:\PROGRA~1\NORTON~2\navapw32.exe
D:\Program Files\Norton Internet Security\IAMAPP.EXE
D:\Program Files\Common Files\Real\Update_OB\realsched.exe
D:\WINDOWS\system32\rkmpkk.exe
D:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\hotfoon4.exe
D:\WINDOWS\system32\wscntfy.exe
D:\COMPROB\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start

Page =

http://groups-beta.google.com/group/24hoursupport.helpdesk
O2 - BHO: Google Toolbar Helper -

{AA58ED58-01DD-4d91-8333-CF10577473F7} - d:\program

files\google\googletoolbar1.dll
O2 - BHO: NAV Helper -

{BDF3E430-B101-42AD-A544-FADC6B084872} - D:\Program

Files\Norton Antivirus\NavShExt.dll
O3 - Toolbar: &Google -

{2318C2B1-4965-11d4-9B18-009027A5CD4F} - d:\program

files\google\googletoolbar1.dll
O3 - Toolbar: Norton AntiVirus -

{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - D:\Program

Files\Norton Antivirus\NavShExt.dll
O4 - HKLM\..\Run: [NAV Agent]

D:\PROGRA~1\NORTON~2\navapw32.exe
O4 - HKLM\..\Run: [iamapp] D:\Program Files\Norton

Internet Security\IAMAPP.EXE
O4 - HKLM\..\Run: [TkBellExe] "D:\Program Files\Common

Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [KavSvc] D:\WINDOWS\system32\rkmpkk.exe

reg_run
O4 - HKCU\..\Run: [msnmsgr] "D:\Program Files\MSN

Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [HOTFOON2] C:\Program Files\hotfoon4.exe

/h
O8 - Extra context menu item: &Google Search -

res://D:\Program

Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word -

res://D:\Program

Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links -

res://D:\Program

Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page -

res://D:\Program

Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel -

res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages -

res://D:\Program

Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English

- res://D:\Program

Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Messenger -

{4528BBE0-4E08-11D5-AD55-00010333D0AD} - D:\Program

Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger -

{4528BBE0-4E08-11D5-AD55-00010333D0AD} - D:\Program

Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: AOL Toolbar -

{4982D40A-C53B-4615-B15B-B5B5E98D167C} - D:\Program

Files\AOL Toolbar\toolbar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar -

{4982D40A-C53B-4615-B15B-B5B5E98D167C} - D:\Program

Files\AOL Toolbar\toolbar.dll
O9 - Extra button: Research -

{92780B25-18CC-41C8-B9BE-3C9C571A8263} -

D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Share in Hello -

{B13B4423-2647-4cfc-A4B3-C7D56CB83487} - D:\Program

Files\Hello\PicasaCapture.dll
O9 - Extra 'Tools' menuitem: Share in H&ello -

{B13B4423-2647-4cfc-A4B3-C7D56CB83487} - D:\Program

Files\Hello\PicasaCapture.dll
O9 - Extra button: Messenger -

{FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program

Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger -

{FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program

Files\Messenger\msmsgs.exe
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1}

(ActiveScan Installer Class) -

http://www.pandasoftware.com/activescan/as5/asinst.cab
O20 - Winlogon Notify: igfxcui -

D:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Adobe LM Service - Adobe Systems -

D:\Program Files\Common Files\Adobe Systems

Shared\Service\Adobelmsvc.exe
O23 - Service: AOL Connectivity Service (AOL ACS) -

America Online, Inc. -

D:\PROGRA~1\COMMON~1\AOL\ACS\AOLACSD.EXE
O23 - Service: AOL Spyware Protection Service (AOLService)

- Unknown owner -

D:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\\aolserv.exe
O23 - Service: ewido security suite control - ewido

networks - D:\Program Files\ewido\security

suite\ewidoctrl.exe
O23 - Service: Norton AntiVirus Auto Protect Service

(navapsvc) - Symantec Corporation - D:\Program

Files\Norton Antivirus\navapsvc.exe
O23 - Service: Norton Internet Security Service (NISSERV)

- Symantec Corporation - D:\Program Files\Norton Internet

Security\NISSERV.EXE
O23 - Service: Norton Internet Security Accounts Manager

(NISUM) - Symantec Corporation - D:\Program Files\Norton

Internet Security\NISUM.EXE
O23 - Service: ScriptBlocking Service (SBService) -

Symantec Corporation -

D:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc)

- Symantec Corporation - D:\Program Files\Common

Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Norton Internet Security Proxy Service

(SymProxySvc) - Symantec Corporation - D:\Program

Files\Norton Internet Security\SymProxySvc.exe
O23 - Service: WinFax PRO (wfxsvc) - Symantec Corporation

- D:\WINDOWS\system32\WFXSVC.EXE


Active Scan Log
Incident Status Location

Adware:Adware/AdBehavior No disinfected D:\WINDOWS\system32\reuieep.dll
Adware:Adware/AdBehavior No disinfected D:\Documents and Settings\All Users\Start Menu\Programs\Startup\ndti.exe
Adware:Adware/AdBehavior No disinfected D:\WINDOWS\system32\rkmpkk.exe
Adware:Adware/AdBehavior No disinfected D:\Documents and Settings\All Users\Start Menu\Programs\Startup\ndti.exe
Adware:Adware/SaveNow No disinfected D:\Documents and Settings\All Users\Application Data\nsv
Spyware:Spyware/BargainBuddy No disinfected D:\WINDOWS\system32\bbchk.exe
Spyware:Spyware/BetterInet No disinfected D:\WINDOWS\inf\banner.inf
Adware:Adware/PortalScan No disinfected Windows Registry
Adware:Adware/SAHAgent No disinfected D:\WINDOWS\unstall.exe
Adware:Adware/BookedSpace No disinfected Windows Registry
Adware:Adware/Apropos No disinfected D:\WINDOWS\system32\auto_update_uninstall.???
Adware:Adware/WinTools No disinfected Windows Registry
Adware:Adware/AdDestroyer No disinfected D:\Documents and Settings\All Users\Application Data\AdDestroyer
Adware:Adware/VirtualBouncer No disinfected D:\Documents and Settings\All Users\Application Data\VBouncer
Adware:Adware/DelFinMedia No disinfected D:\WINDOWS\system32\nsvsvc
Spyware:Spyware/Media-motor No disinfected Windows Registry
Adware:Adware/Fizzle No disinfected D:\Program Files\FwBarTemp
Adware:Adware/EliteBar No disinfected Windows Registry
Adware:Adware/ExactSearch No disinfected D:\WINDOWS\system32\exdl.exe
Adware:Adware/PowerSearch No disinfected D:\WINDOWS\system32\stlb2.xml
Spyware:Spyware/SurfSideKick No disinfected Windows Registry
Adware:Adware/Weirdontheweb No disinfected D:\Documents and Settings\Administrator\Favorites\WeirdOnTheWeb.url
Adware:Adware/BHO No disinfected C:\WINDOWS\SYSTEM\hosts.2
Adware:Adware/SAHAgent No disinfected C:\WINDOWS\INF\BI.INF
Adware:Adware/SAHAgent No disinfected C:\WINDOWS\INF\payload.inf
Adware:Adware/Transponder No disinfected C:\WINDOWS\INF\POLMX2.INF
Spyware:Spyware/BetterInet No disinfected C:\WINDOWS\INF\SATMAT.INF
Adware:Adware/SAHAgent No disinfected C:\WINDOWS\TEMP\bi.inf
Spyware:Spyware/BetterInet No disinfected C:\WINDOWS\TEMP\biini.cab[biini.inf]
Adware:Adware/Transponder No disinfected C:\WINDOWS\TEMP\polmx2.inf
Spyware:Spyware/BetterInet No disinfected C:\WINDOWS\TEMP\satmat.inf
Adware:Adware/IPInsight No disinfected C:\WINDOWS\TEMP\satmat.ini
Adware:Adware/Transponder No disinfected C:\WINDOWS\All Users\Application Data\AOL\storage\cache.db[polall1r.inf]
Adware:Adware/FunWeb No disinfected C:\WINDOWS\Downloaded Program Files\f3initialsetup1.0.0.5.inf
Spyware:Spyware/BetterInet No disinfected C:\WINDOWS\Downloaded Program Files\flash.inf
Adware:Adware/BHO No disinfected C:\WINDOWS\hosts
Adware:Adware/BHO No disinfected C:\WINDOWS\hosts.1
Adware:Adware/IPInsight No disinfected C:\WINDOWS\SATMAT.INI
Adware:Adware/Apropos No disinfected C:\Program Files\Aprps\ProxyStub.dll
Spyware:Spyware/BargainBuddy No disinfected D:\WINDOWS\system32\exdl.exe
Adware:Adware/AdBehavior No disinfected D:\WINDOWS\system32\rkmpkk.exe
Spyware:Spyware/BargainBuddy No disinfected D:\WINDOWS\system32\mqexdlm.srg
Adware:Adware/AdBehavior No disinfected D:\WINDOWS\system32\pqvkq.dat
Adware:Adware/ExactSearch No disinfected D:\WINDOWS\system32\exul.exe
Adware:Adware/AdBehavior No disinfected D:\WINDOWS\system32\reuieep.dll
Adware:Adware/ExactSearch No disinfected D:\WINDOWS\system32\javexulm.vxd
Adware:Adware/PortalScan No disinfected D:\WINDOWS\system32\winupdt.bin
Adware:Adware/ConsumerAlertSystemNo disinfected D:\WINDOWS\system32\Cache\dist006.exe
Adware:Adware/PortalScan No disinfected D:\WINDOWS\system32\winupdt.008
Adware:Adware/Adshooter No disinfected D:\WINDOWS\system32\ca.dll
Adware:Adware/ConsumerAlertSystemNo disinfected D:\WINDOWS\system32\dist001.exe
Virus:Trj/Downloader.DKB Disinfected D:\WINDOWS\system32\bcomccn.exe
Adware:Adware/AdBehavior No disinfected D:\WINDOWS\system32\urnsr.dll
Spyware:Spyware/BargainBuddy No disinfected D:\WINDOWS\system32\bbchk.exe
Spyware:Spyware/BargainBuddy No disinfected D:\WINDOWS\system32\exclean.exe
Adware:Adware/PowerSearch No disinfected D:\WINDOWS\system32\stlb2.xml
Adware:Adware/Apropos No disinfected D:\WINDOWS\system32\auto_update_uninstall.log
Spyware:Spyware/BetterInet No disinfected D:\WINDOWS\system\QBUninstaller.exe
Spyware:Spyware/BetterInet No disinfected D:\WINDOWS\inf\banner.inf
Adware:Adware/AdBehavior No disinfected D:\WINDOWS\pss\ndti.exeCommon Startup
Spyware:Spyware/Media-motor No disinfected D:\WINDOWS\Downloaded Program Files\m67m.inf
Spyware:Spyware/Media-motor No disinfected D:\WINDOWS\unstall.exe
Adware:Adware/WinTools No disinfected D:\WINDOWS\hisistheurls.exe
Adware:Adware/AdBehavior No disinfected D:\Documents and Settings\All Users\Start Menu\Programs\Startup\ndti.exe
Adware:Adware/Weirdontheweb No disinfected D:\Documents and Settings\Administrator\Favorites\WeirdOnTheWeb.url
Spyware:Spyware/BargainBuddy No disinfected D:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\QFle0612200518003681781.asw
Spyware:Spyware/BargainBuddy No disinfected D:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\QFle0612200518003681921.asw
Adware:Adware/Envolo No disinfected D:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\QFle0612200518003687562.asw
Spyware:Spyware/BargainBuddy No disinfected D:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\QFle0612200518003718375.asw
Spyware:Spyware/BargainBuddy No disinfected D:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\QFle0612200518003718406.asw
Spyware:Spyware/BargainBuddy No disinfected D:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\QFle06142005231034414812.asw
Spyware:Spyware/BargainBuddy No disinfected D:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\QFle06142005231034414828.asw
Adware:Adware/Envolo No disinfected D:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\QFle06142005231034415890.asw
Spyware:Spyware/BargainBuddy No disinfected D:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\QFle06142005231034423796.asw
Adware:Adware/Searchforit No disinfected D:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\QMem06152005133922622343.asw
Adware:Adware/Envolo No disinfected D:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\QFle0617200500157358218.asw
Adware:Adware/ConsumerAlertSystemNo disinfected D:\Program Files\CasStub\casstub.exe
Adware:Adware/ConsumerAlertSystemNo disinfected D:\Program Files\Cas\Client\casmf.dll
Adware:Adware/ConsumerAlertSystemNo disinfected D:\Program Files\Cas\Client\casclient.exe
Adware:Adware/ConsumerAlertSystemNo disinfected D:\Program Files\Cas\Client\Uninstall.exe
Adware:Adware/Searchforit No disinfected D:\COMPROB\backups\backup-20050618-234530-825.dll
Adware:Adware/AdBehavior No disinfected D:\COMPROB\backups\backup-20050703-161539-343-ndti.exe
Post #40
Step 1
Double-click on Killbox.exe to start the program.
In the killbox program, select the Delete on Reboot option.
In the field labeled Full Path of File to Delete enter the file paths listed below ONE AT A TIME (EXACTLY as it appears, please double check to make sure!):

D:\WINDOWS\system32\reuieep.dll
D:\WINDOWS\system32\rkmpkk.exe
D:\WINDOWS\system32\bbchk.exe
D:\WINDOWS\system32\nsvsvc
D:\WINDOWS\system32\exdl.exe
D:\WINDOWS\system32\stlb2.xml
D:\WINDOWS\system32\mqexdlm.srg
D:\WINDOWS\system32\pqvkq.dat
D:\WINDOWS\system32\exul.exe
D:\WINDOWS\system32\javexulm.vxd
D:\WINDOWS\system32\winupdt.bin
D:\WINDOWS\system32\Cache\dist006.exe
D:\WINDOWS\system32\winupdt.008
D:\WINDOWS\system32\ca.dll
D:\WINDOWS\system32\dist001.exe
D:\WINDOWS\system32\bcomccn.exe
D:\WINDOWS\system32\urnsr.dll
D:\WINDOWS\system32\exclean.exe
D:\WINDOWS\system32\auto_update_uninstall.log
D:\Documents and Settings\All Users\Start Menu\Programs\Startup\ndti.exe
D:\Documents and Settings\All Users\Application Data\nsv
D:\Documents and Settings\All Users\Application Data\AdDestroyer
D:\Documents and Settings\All Users\Application Data\VBouncer
D:\Documents and Settings\Administrator\Favorites\WeirdOnTheWeb.url
D:\WINDOWS\unstall.exe
D:\WINDOWS\hisistheurls.exe
D:\WINDOWS\inf\banner.inf
C:\WINDOWS\INF\BI.INF
C:\WINDOWS\INF\payload.inf
C:\WINDOWS\INF\POLMX2.INF
C:\WINDOWS\INF\SATMAT.INF
C:\WINDOWS\Downloaded Program Files\f3initialsetup1.0.0.5.inf
C:\WINDOWS\Downloaded Program Files\flash.inf
C:\WINDOWS\SATMAT.INI
C:\Program Files\Aprps\ProxyStub.dll
D:\Program Files\FwBarTemp
D:\Program Files\CasStub\casstub.exe
D:\Program Files\Cas\Client\casmf.dll
D:\Program Files\Cas\Client\casclient.exe
D:\Program Files\Cas\Client\Uninstall.exe
D:\WINDOWS\system\QBUninstaller.exe
D:\WINDOWS\pss\ndti.exeCommon Startup
D:\WINDOWS\Downloaded Program Files\m67m.inf

Press the button that looks like a red circle with a white X in it after each one. When it asks if you would like to delete on reboot, press the YES button, when it asks if you want to reboot now, press the NO button. Do this after each one until you have entered the LAST file path I have listed above. After that LAST file path has been entered, press the YES button at both prompts so that your computer restarts.
If you get a "PendingFileRenameOperations Registry Data has been Removed by External Process!" message then just restart manually.


Step 2
Open HijackThis, run a scan, then check the following:

O4 - HKLM\..\Run: [KavSvc] D:\WINDOWS\system32\rkmpkk.exe reg_run

With all other programs and browsers closed, click fix checked.


Step 3
Reboot normally and scan with HijackThis. Post the new log as a reply to this thread. Include a new Panda ActiveScan log.
Be sure to turn off Word Wrap in Notepad before replying. (In Notepad, click Format and uncheck Word Wrap)
Post #41
Logfile of HijackThis v1.99.1
Scan saved at 1:08:35 AM, on 7/9/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\system32\spoolsv.exe
D:\PROGRA~1\NORTON~2\navapw32.exe
D:\Program Files\Norton Internet Security\IAMAPP.EXE
D:\PROGRA~1\COMMON~1\AOL\ACS\AOLACSD.EXE
D:\Program Files\Common Files\Real\Update_OB\realsched.exe
D:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\hotfoon4.exe
D:\Program Files\ewido\security suite\ewidoctrl.exe
D:\Program Files\Norton Antivirus\navapsvc.exe
D:\Program Files\Norton Internet Security\NISUM.EXE
D:\WINDOWS\System32\svchost.exe
D:\Program Files\Norton Internet Security\SymProxySvc.exe
D:\WINDOWS\system32\WFXSVC.EXE
D:\Program Files\Norton Internet Security\NISSERV.EXE
D:\Program Files\Symantec\WinFax\WFXMOD32.EXE
D:\WINDOWS\system32\wscntfy.exe
D:\WINDOWS\system32\wuauclt.exe
D:\WINDOWS\System32\svchost.exe
D:\COMPROB\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://groups-beta.google.com/group/24hoursupport.helpdesk
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - d:\program files\google\googletoolbar1.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - D:\Program Files\Norton Antivirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - d:\program files\google\googletoolbar1.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - D:\Program Files\Norton Antivirus\NavShExt.dll
O4 - HKLM\..\Run: [NAV Agent] D:\PROGRA~1\NORTON~2\navapw32.exe
O4 - HKLM\..\Run: [iamapp] D:\Program Files\Norton Internet Security\IAMAPP.EXE
O4 - HKLM\..\Run: [TkBellExe] "D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [msnmsgr] "D:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [HOTFOON2] C:\Program Files\hotfoon4.exe /h
O8 - Extra context menu item: &Google Search - res://D:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://D:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://D:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://D:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://D:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://D:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - D:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - D:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - D:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - D:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Share in Hello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - D:\Program Files\Hello\PicasaCapture.dll
O9 - Extra 'Tools' menuitem: Share in H&ello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - D:\Program Files\Hello\PicasaCapture.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O20 - Winlogon Notify: igfxcui - D:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Adobe LM Service - Adobe Systems - D:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - D:\PROGRA~1\COMMON~1\AOL\ACS\AOLACSD.EXE
O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - D:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\\aolserv.exe
O23 - Service: ewido security suite control - ewido networks - D:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - D:\Program Files\Norton Antivirus\navapsvc.exe
O23 - Service: Norton Internet Security Service (NISSERV) - Symantec Corporation - D:\Program Files\Norton Internet Security\NISSERV.EXE
O23 - Service: Norton Internet Security Accounts Manager (NISUM) - Symantec Corporation - D:\Program Files\Norton Internet Security\NISUM.EXE
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - D:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Norton Internet Security Proxy Service (SymProxySvc) - Symantec Corporation - D:\Program Files\Norton Internet Security\SymProxySvc.exe
O23 - Service: WinFax PRO (wfxsvc) - Symantec Corporation - D:\WINDOWS\system32\WFXSVC.EXE
Post #42
Finally, that's a clean log. :thumbup: Please scan again with Panda Activescan and post the new log so I can make sure we got everything. When you post the new Panda log, let me know how the computer is working.
Post #43 last edited
It's too early,half sleep ,after rebooting I found bigger toolbars(example infront of Guided/Normal Mode) within page.After sometime it's size restored to normal size itself.
Numerical Keys locked sometimes,but that happened some times in the past too,don't know how it restore itself,tried mouse/keyboard settings.
Moreover it's to be noted that I run AOL Spyware in safe mode after first cycle of HJT and Panda scanning which discoverd 8 spywares ,later I blocked and deleted these spywares there:
Name Description Threat Level
BookedSpace: BHO: Elevated
Remanent: Rouge Activex: Elevated

ComLoad: Rouge Activex,Drive by
Download,Dialer: Elevated

TopMoxie: Adware: Elevated
BargainBuddy: Adware: Elevated
ExactAdvertising: Adware: Elevated
Navisearch: Searchpage Highjacker,BHO: Elevated
BullseyeNetwork: Searchpage Highjacker,BHO: Guarded


Panda Active Log @4:55 A.M
Incident Status Location

Adware:Adware/SaveNow No disinfected D:\Documents and Settings\All Users\Application Data\nsv
Adware:Adware/PortalScan No disinfected Windows Registry
Adware:Adware/VirtualBouncer No disinfected D:\Documents and Settings\All Users\Application Data\VBouncer
Adware:Adware/DelFinMedia No disinfected D:\WINDOWS\system32\nsvsvc
Spyware:Spyware/Media-motor No disinfected Windows Registry
Adware:Adware/Fizzle No disinfected D:\Program Files\FwBarTemp
Adware:Adware/EliteBar No disinfected Windows Registry
Adware:Adware/BHO No disinfected C:\WINDOWS\SYSTEM\hosts.2
Adware:Adware/SAHAgent No disinfected C:\WINDOWS\TEMP\bi.inf
Spyware:Spyware/BetterInet No disinfected C:\WINDOWS\TEMP\biini.cab[biini.inf]
Adware:Adware/Transponder No disinfected C:\WINDOWS\TEMP\polmx2.inf
Spyware:Spyware/BetterInet No disinfected C:\WINDOWS\TEMP\satmat.inf
Adware:Adware/IPInsight No disinfected C:\WINDOWS\TEMP\satmat.ini
Adware:Adware/Transponder No disinfected C:\WINDOWS\All Users\Application Data\AOL\storage\cache.db[polall1r.inf]
Adware:Adware/BHO No disinfected C:\WINDOWS\hosts
Adware:Adware/BHO No disinfected C:\WINDOWS\hosts.1
Adware:Adware/ExactSearch No disinfected D:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\QFle0708200521522590515.asw
Spyware:Spyware/BargainBuddy No disinfected D:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\QFle0612200518003681781.asw
Spyware:Spyware/BargainBuddy No disinfected D:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\QFle0612200518003681921.asw
Adware:Adware/Envolo No disinfected D:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\QFle0612200518003687562.asw
Spyware:Spyware/BargainBuddy No disinfected D:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\QFle0612200518003718375.asw
Spyware:Spyware/BargainBuddy No disinfected D:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\QFle0612200518003718406.asw
Spyware:Spyware/BargainBuddy No disinfected D:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\QFle06142005231034414812.asw
Spyware:Spyware/BargainBuddy No disinfected D:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\QFle06142005231034414828.asw
Adware:Adware/Envolo No disinfected D:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\QFle06142005231034415890.asw
Spyware:Spyware/BargainBuddy No disinfected D:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\QFle06142005231034423796.asw
Adware:Adware/Searchforit No disinfected D:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\QMem06152005133922622343.asw
Adware:Adware/Envolo No disinfected D:\Program Files\Common Files\AOL\AOL Spyware Protection\Backup\QFle0617200500157358218.asw
Adware:Adware/Searchforit No disinfected D:\COMPROB\backups\backup-20050618-234530-825.dll
Adware:Adware/AdBehavior No disinfected D:\COMPROB\backups\backup-20050703-161539-343-ndti.exe
Post #44
Please set your computer to show all files.
  • Double-click My Computer.
  • Click the Tools menu, and then click Folder Options.
  • Click the View tab.
  • Clear "Hide file extensions for known file types."
  • Under the "Hidden files" folder, select "Show hidden files and folders."
  • Clear "Hide protected operating system files."
  • Click Apply, and then click OK.
You will need to reverse this process when all steps are done.


Delete the following folders:

D:\Documents and Settings\All Users\Application Data\nsv
D:\Documents and Settings\All Users\Application Data\VBouncer
D:\WINDOWS\system32\nsvsvc
D:\Program Files\FwBarTemp
D:\Program Files\Cas


I'd like to see one more HijackThis log to be sure it is still clean. How is the computer working now?

I suggest that you get these programs to help keep the computer clean:

Spyware Blaster - Blocks bad ActiveX items from installing on your computer. Spyware Blaster runs silently in the background.
SpywareGuard - Real-time protection from spyware installation attempts
ie-spyad - Puts over 8,000 bad URLs into your restricted sites for Internet Explorer.
Google Toolbar - Blocks many unwanted pop-ups in Internet Explorer.
Firefox - 'Safer' alternative to the Internet Explorer web browser.

Update these regularly.

You may also want to read "How did I get infected in the first place" to learn how to better secure your computer.

Be sure to keep Windows and your Anti-virus updated.
Post #45
I have deleted specified folders,and here is my fresh HJT log.I am busy in restoring other older systems,so not sitting full time on this PC.Many thanks Sir.
Logfile of HijackThis v1.99.1
Scan saved at 12:04:00 AM, on 7/10/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\system32\spoolsv.exe
D:\PROGRA~1\NORTON~2\navapw32.exe
D:\Program Files\Norton Internet Security\IAMAPP.EXE
D:\Program Files\Common Files\Real\Update_OB\realsched.exe
D:\Program Files\MSN Messenger\msnmsgr.exe
D:\PROGRA~1\COMMON~1\AOL\ACS\AOLACSD.EXE
C:\Program Files\hotfoon4.exe
D:\Program Files\ewido\security suite\ewidoctrl.exe
D:\Program Files\Norton Antivirus\navapsvc.exe
D:\Program Files\Norton Internet Security\NISUM.EXE
D:\WINDOWS\System32\svchost.exe
D:\Program Files\Norton Internet Security\SymProxySvc.exe
D:\WINDOWS\system32\WFXSVC.EXE
D:\Program Files\Norton Internet Security\NISSERV.EXE
D:\Program Files\Symantec\WinFax\WFXMOD32.EXE
D:\WINDOWS\system32\wscntfy.exe
D:\WINDOWS\System32\svchost.exe
D:\COMPROB\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://groups-beta.google.com/group/24hoursupport.helpdesk
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - d:\program files\google\googletoolbar1.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - D:\Program Files\Norton Antivirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - d:\program files\google\googletoolbar1.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - D:\Program Files\Norton Antivirus\NavShExt.dll
O4 - HKLM\..\Run: [NAV Agent] D:\PROGRA~1\NORTON~2\navapw32.exe
O4 - HKLM\..\Run: [iamapp] D:\Program Files\Norton Internet Security\IAMAPP.EXE
O4 - HKLM\..\Run: [TkBellExe] "D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [msnmsgr] "D:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [HOTFOON2] C:\Program Files\hotfoon4.exe /h
O8 - Extra context menu item: &Google Search - res://D:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://D:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://D:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://D:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://D:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://D:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - D:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - D:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - D:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - D:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Share in Hello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - D:\Program Files\Hello\PicasaCapture.dll
O9 - Extra 'Tools' menuitem: Share in H&ello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - D:\Program Files\Hello\PicasaCapture.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O20 - Winlogon Notify: igfxcui - D:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Adobe LM Service - Adobe Systems - D:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - D:\PROGRA~1\COMMON~1\AOL\ACS\AOLACSD.EXE
O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - D:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\\aolserv.exe
O23 - Service: ewido security suite control - ewido networks - D:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - D:\Program Files\Norton Antivirus\navapsvc.exe
O23 - Service: Norton Internet Security Service (NISSERV) - Symantec Corporation - D:\Program Files\Norton Internet Security\NISSERV.EXE
O23 - Service: Norton Internet Security Accounts Manager (NISUM) - Symantec Corporation - D:\Program Files\Norton Internet Security\NISUM.EXE
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - D:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Norton Internet Security Proxy Service (SymProxySvc) - Symantec Corporation - D:\Program Files\Norton Internet Security\SymProxySvc.exe
O23 - Service: WinFax PRO (wfxsvc) - Symantec Corporation - D:\WINDOWS\system32\WFXSVC.EXE

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI