What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Log File New user

9 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Any help with this is appreciated.
Logfile of HijackThis v1.99.1
Scan saved at 2:50:09 PM, on 6/16/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\McAfee\McAfee Privacy Service\GUARDDOG.EXE
C:\WINDOWS\System32\cisvc.exe
C:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFSERVICE.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\McAfee\McAfee Privacy Service\GUARDDOG.EXE
C:\WINDOWS\System32\S3apphk.exe
C:\WINDOWS\essspk.exe
C:\Program Files\MSN Apps\Updater\01.03.0000.1005\en-us\msnappau.exe
C:\Program Files\Lexmark X5100 Series\lxbabmgr.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
C:\Program Files\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe
C:\Program Files\Lexmark X5100 Series\lxbabmon.exe
C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe
C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFTRAY.EXE
C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\svchost.exe
C:\Program Files\McAfee\Secure IE\SIEPulse.exe
C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\Playlist.exe
C:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFAGENT.EXE
c:\program files\mcafee.com\vso\mcvsshld.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\WINDOWS\System32\cidaemon.exe
C:\PROGRA~1\AIM\aim.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Outlook Express\msimn.exe
C:\PROGRA~1\McAfee\SECURE~1\SecureIE.exe
C:\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL =

http://www.gophersearch.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =

http://www.gophersearch.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =

http://www.gophersearch.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

http://www.gophersearch.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

http://www.gophersearch.com/
R3 - Default URLSearchHook is missing
O2 - BHO: ohb - {22DFEAE8-9AD2-4FC6-9CBA-A6566CA3B6EB} -

C:\WINDOWS\System32\gpstool.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} -

C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program

Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: Google Toolbar Helper -

{AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program

files\google\googletoolbar1.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} -

C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll
O3 - Toolbar: McAfee VirusScan -

{BA52B914-B692-46c4-B683-905236F6F655} -

c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} -

c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -

C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [S3apphk] S3apphk.exe
O4 - HKLM\..\Run: [EssSpkPhone] essspk.exe
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN

Apps\Updater\01.03.0000.1005\en-us\msnappau.exe"
O4 - HKLM\..\Run: [Lexmark X5100 Series] "C:\Program Files\Lexmark X5100

Series\lxbabmgr.exe"
O4 - HKLM\..\Run: [MCUpdateExe]

C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [MSKAGENTEXE]

C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
O4 - HKLM\..\Run: [VSOCheckTask]

"c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [McAfee Guardian] C:\Program Files\McAfee\McAfee

Shared Components\Guardian\CMGrdian.exe /SU
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common

Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD

Creator 6\DragToDisc\DrgToDsc.exe"
O4 - HKLM\..\Run: [RoxioAudioCentral] "C:\Program Files\Roxio\Easy CD

Creator 6\AudioCentral\RxMon.exe"
O4 - HKLM\..\Run: [MCAgentExe]

C:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [VirusScan Online]

"c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [MSKDetectorExe]

C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe /startup
O4 - HKLM\..\Run: [MPFTray]

C:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFTRAY.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program

Files\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [WildTangent CDA] RUNDLL32.exe "C:\Program

Files\WildTangent\Apps\CDA\cdaEngine0400.dll",cdaEngineMain
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe"

-atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common

Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Windows DLL Services] C:\svchost.exe
O4 - HKLM\..\Run: [SIE2004] "C:\Program Files\McAfee\Secure

IE\SIEPulse.exe"
O4 - HKLM\..\Run: [McRegWiz]

C:\PROGRA~1\McAfee.com\Agent\McRegWiz.exe /autorun
O4 - HKLM\..\Run: [SpybotSnD] "C:\Program Files\Spybot - Search &

Destroy\SpybotSD.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search &

Destroy\TeaTimer.exe
O4 - Global Startup: winlogin.exe
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program

Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501}

- C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console -

{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program

Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} -

C:\PROGRA~1\AIM\aim.exe
O9 - Extra button: Privacy Bar - {cc4b2ee5-4803-11d7-8a38-00b0d0c6b814} -

C:\Program Files\McAfee\McAfee Privacy Service\GDIEHELP.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -

C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger -

{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

Files\Messenger\MSMSGS.EXE
O12 - Plugin for .pdf: C:\Program Files\Internet

Explorer\PLUGINS\nppdf32.dll
O15 - Trusted Zone: createpdf.adobe.com
O15 - Trusted Zone: www.alexa.com
O15 - Trusted Zone: www.allthingscedar.com
O15 - Trusted Zone: www.amvona.com
O15 - Trusted Zone: www.andersonteak.com
O15 - Trusted Zone: www.grandrapids.bbb.org
O15 - Trusted Zone: www.bbbonline.org
O15 - Trusted Zone: www.brainyquote.com
O15 - Trusted Zone: www.centurytel.com
O15 - Trusted Zone: dslst.mx.centurytel.net
O15 - Trusted Zone: www.consumersenergy.com
O15 - Trusted Zone: www.countrycritter.com
O15 - Trusted Zone: securesite.cusiteonline.com
O15 - Trusted Zone: www.custom-teak.com
O15 - Trusted Zone: www.dreamsalivemagazine.com
O15 - Trusted Zone: www.duvera.com
O15 - Trusted Zone: www.easy-reciprocal-links.com
O15 - Trusted Zone: my.ebay.com
O15 - Trusted Zone: www.eci-pay.com
O15 - Trusted Zone: www.excaliburbrothers.com
O15 - Trusted Zone: www.find-information-on.com
O15 - Trusted Zone: www.furnado.com
O15 - Trusted Zone: *.furnitureshoppingtips.com
O15 - Trusted Zone: www.godaddy.com
O15 - Trusted Zone: www.howtogetanythingyouwant.com
O15 - Trusted Zone: www.instantinternetprofits.com
O15 - Trusted Zone: www.instantmarketingtoolbox.com
O15 - Trusted Zone: www.instantsalesletters.com
O15 - Trusted Zone: www.iwebtrack.com
O15 - Trusted Zone: *.java.com
O15 - Trusted Zone: *.jewelleryshopper.ca
O15 - Trusted Zone: www.kwmap.com
O15 - Trusted Zone: www.lochnesswatergardens.com
O15 - Trusted Zone: www.misbtdc.org
O15 - Trusted Zone: www.modguys.com
O15 - Trusted Zone: www.mplusgps.com
O15 - Trusted Zone: www.myownemail.com
O15 - Trusted Zone: www.nepalnet.net
O15 - Trusted Zone: www.netmechanic.com
O15 - Trusted Zone: *.outdoor-patio-furniture.biz
O15 - Trusted Zone: www.pioneer-michigan.com
O15 - Trusted Zone: www.rlrouse.com
O15 - Trusted Zone: *.searchenginewatch.com
O15 - Trusted Zone: *.secure-ss.com
O15 - Trusted Zone: www.sherrysellsseashells.com
O15 - Trusted Zone: myws.sitesell.com
O15 - Trusted Zone: www.sitesell.com
O15 - Trusted Zone: www.sitetube.com
O15 - Trusted Zone: www2.smcorp.com
O15 - Trusted Zone: www.storesonline.com
O15 - Trusted Zone: www.surefiremarketing.com
O15 - Trusted Zone: www.teakalook.com
O15 - Trusted Zone: www.thehungerinside.com
O15 - Trusted Zone: www.thomasregister.com
O15 - Trusted Zone: www.thosbaker.com
O15 - Trusted Zone: dir.thumbshots.net
O15 - Trusted Zone: www.trendmicro.com
O15 - Trusted Zone: *.vanbarniknakstuff.biz
O15 - Trusted Zone: www.vboutdoorteakfurniture.com
O15 - Trusted Zone: www.viking.com
O15 - Trusted Zone: www.vistaworks.com
O15 - Trusted Zone: www.walmart.com
O15 - Trusted Zone: www.wealthylegacy.com
O15 - Trusted Zone: www.westminsterteak.com
O15 - Trusted Zone: *.whois.sc
O15 - Trusted Zone: webmonkey.wired.com
O15 - Trusted Zone: www.worldwidebrands.com
O15 - Trusted Zone: www.yanikrecommends.com
O20 - AppInit_DLLs: jz95o1rujb2grgd.dll.dll.dll.dll.dll.dll.dll
O23 - Service: McAfee Privacy Service (GuardDogEXE) - Unknown owner -

C:\Program Files\McAfee\McAfee Privacy Service\GUARDDOG.EXE" /SERVICE

(file missing)
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. -

C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: McAfee.com McShield (McShield) - Unknown owner -

c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) -

McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) -

Networks Associates Technology, Inc -

c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee

Corporation - C:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFSERVICE.exe
O23 - Service: McAfee SpamKiller Server (MskService) - Networks Associates

Technology. Inc. - C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
Post #3
I know you are all busy with the help you are giving others…but I really need this trojan that keeps coming back off my computer….Is there anyone that can help me out??? Please. :(
Post #4
Everytime I use the internet in any way I get this wonderful hijack. It will open up porn sites, win cash sites, and other useless sites. I have updated McAfee and run virus scan after virus scan, it will find a trojan named downloader qg I let McAfee clean it. I also have run Adaware and remove things it finds, SpyBot also. This 'thing' keeps coming back. I have also gone to my temp folder and tried to clean it. I get a messege that says it can't be removed because it is being used by someone else or another program. So any and all help is deeply apprciated.
If you need any more info let me know, I will gladly provide it. :wavey:

Logfile of HijackThis v1.99.1
Scan saved at 11:35:21 AM, on 6/22/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\McAfee\McAfee Privacy Service\GUARDDOG.EXE
C:\WINDOWS\System32\cisvc.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFSERVICE.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\fxssvc.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\WINDOWS\System32\cidaemon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\McAfee\McAfee Privacy Service\GUARDDOG.EXE
C:\WINDOWS\System32\S3apphk.exe
C:\WINDOWS\essspk.exe
C:\Program Files\MSN Apps\Updater\01.03.0000.1005\en-us\msnappau.exe
C:\Program Files\Lexmark X5100 Series\lxbabmgr.exe
C:\Program Files\Lexmark X5100 Series\lxbabmon.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
C:\Program Files\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFTRAY.EXE
C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
C:\svchost.exe
C:\PROGRA~1\McAfee\SECURE~1\SIEPulse.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\System32\lexpps.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFAGENT.EXE
C:\PROGRA~1\AIM\aim.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\McAfee\SECURE~1\SecureIE.exe
C:\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.gophersearch.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.gophersearch.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.gophersearch.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.gophersearch.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.gophersearch.com/
R3 - Default URLSearchHook is missing
O2 - BHO: ohb - {22DFEAE8-9AD2-4FC6-9CBA-A6566CA3B6EB} - C:\WINDOWS\System32\gpstool.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [S3apphk] S3apphk.exe
O4 - HKLM\..\Run: [EssSpkPhone] essspk.exe
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.03.0000.1005\en-us\msnappau.exe"
O4 - HKLM\..\Run: [Lexmark X5100 Series] "C:\Program Files\Lexmark X5100 Series\lxbabmgr.exe"
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [McAfee Guardian] C:\Program Files\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe /SU
O4 - HKLM\..\Run: [MCAgentExe] C:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [MSKDetectorExe] C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe /startup
O4 - HKLM\..\Run: [MPFTray] C:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFTRAY.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [Windows DLL Services] C:\svchost.exe
O4 - HKLM\..\Run: [SIE2004] "C:\PROGRA~1\McAfee\SECURE~1\SIEPulse.exe"
O4 - HKLM\..\Run: [SpybotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: winlogin.exe
O4 - Global Startup: QuickBooks Update Agent.lnk.disabled
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe
O9 - Extra button: Privacy Bar - {cc4b2ee5-4803-11d7-8a38-00b0d0c6b814} - C:\Program Files\McAfee\McAfee Privacy Service\GDIEHELP.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O15 - Trusted Zone: createpdf.adobe.com
O15 - Trusted Zone: www.alexa.com
O15 - Trusted Zone: www.allthingscedar.com
O15 - Trusted Zone: www.amvona.com
O15 - Trusted Zone: www.andersonteak.com
O15 - Trusted Zone: www.grandrapids.bbb.org
O15 - Trusted Zone: www.bbbonline.org
O15 - Trusted Zone: www.brainyquote.com
O15 - Trusted Zone: www.centurytel.com
O15 - Trusted Zone: dslst.mx.centurytel.net
O15 - Trusted Zone: www.consumersenergy.com
O15 - Trusted Zone: www.countrycritter.com
O15 - Trusted Zone: securesite.cusiteonline.com
O15 - Trusted Zone: www.custom-teak.com
O15 - Trusted Zone: www.dreamsalivemagazine.com
O15 - Trusted Zone: www.duvera.com
O15 - Trusted Zone: www.easy-reciprocal-links.com
O15 - Trusted Zone: my.ebay.com
O15 - Trusted Zone: www.eci-pay.com
O15 - Trusted Zone: www.excaliburbrothers.com
O15 - Trusted Zone: www.find-information-on.com
O15 - Trusted Zone: www.furnado.com
O15 - Trusted Zone: *.furnitureshoppingtips.com
O15 - Trusted Zone: www.godaddy.com
O15 - Trusted Zone: www.howtogetanythingyouwant.com
O15 - Trusted Zone: www.instantinternetprofits.com
O15 - Trusted Zone: www.instantmarketingtoolbox.com
O15 - Trusted Zone: www.instantsalesletters.com
O15 - Trusted Zone: www.iwebtrack.com
O15 - Trusted Zone: *.java.com
O15 - Trusted Zone: *.jewelleryshopper.ca
O15 - Trusted Zone: www.kwmap.com
O15 - Trusted Zone: www.lochnesswatergardens.com
O15 - Trusted Zone: www.misbtdc.org
O15 - Trusted Zone: www.modguys.com
O15 - Trusted Zone: www.mplusgps.com
O15 - Trusted Zone: www.myownemail.com
O15 - Trusted Zone: www.nepalnet.net
O15 - Trusted Zone: www.netmechanic.com
O15 - Trusted Zone: *.outdoor-patio-furniture.biz
O15 - Trusted Zone: www.pioneer-michigan.com
O15 - Trusted Zone: www.rlrouse.com
O15 - Trusted Zone: *.searchenginewatch.com
O15 - Trusted Zone: *.secure-ss.com
O15 - Trusted Zone: www.sherrysellsseashells.com
O15 - Trusted Zone: myws.sitesell.com
O15 - Trusted Zone: www.sitesell.com
O15 - Trusted Zone: www.sitetube.com
O15 - Trusted Zone: www2.smcorp.com
O15 - Trusted Zone: www.storesonline.com
O15 - Trusted Zone: www.surefiremarketing.com
O15 - Trusted Zone: www.teakalook.com
O15 - Trusted Zone: www.thehungerinside.com
O15 - Trusted Zone: www.thomasregister.com
O15 - Trusted Zone: www.thosbaker.com
O15 - Trusted Zone: dir.thumbshots.net
O15 - Trusted Zone: www.trendmicro.com
O15 - Trusted Zone: *.vanbarniknakstuff.biz
O15 - Trusted Zone: www.vboutdoorteakfurniture.com
O15 - Trusted Zone: www.viking.com
O15 - Trusted Zone: www.vistaworks.com
O15 - Trusted Zone: www.walmart.com
O15 - Trusted Zone: www.wealthylegacy.com
O15 - Trusted Zone: www.westminsterteak.com
O15 - Trusted Zone: *.whois.sc
O15 - Trusted Zone: webmonkey.wired.com
O15 - Trusted Zone: www.worldwidebrands.com
O15 - Trusted Zone: www.yanikrecommends.com
O20 - AppInit_DLLs: jz95o1rujb2grgd.dll.dll.dll.dll.dll.dll.dll
O23 - Service: McAfee Privacy Service (GuardDogEXE) - Unknown owner - C:\Program Files\McAfee\McAfee Privacy Service\GUARDDOG.EXE" /SERVICE (file missing)
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFSERVICE.exe
O23 - Service: McAfee SpamKiller Server (MskService) - Networks Associates Technology. Inc. - C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe

Thank you,
Bruce
Post #5
Hello VanBar and welcome to TomCoyote. :wavey:'

Step 1
Please download the trial version of Ewido security suite.

Install and Update Ewido:
  • Download and install Ewido security suite.
  • Launch Ewido, there should be an icon on your desktop for it to double-click.
    • The program will prompt you to update, click the OK button.
    • The program will now go to the main screen.
  • You will need to update ewido to the latest definition files.
    • On the left hand side of the main screen click update.
    • Click on Start.
    • The update will start and a progress bar will show the updates being installed.
  • Once the updates are installed, close the program.
Scanning With Ewido:
  • Reboot into Safe Mode (tap F8 during bootup, use arrow keys to select Safe Mode, then hit 'enter').
  • Launch Ewido again.
  • Click on scanner.
  • Make sure the following boxes are checked before scanning:
  • Binder
  • Crypter
  • Archives
[*]Click on Start Scan.
  • Let the program scan the machine.
  • While the scan is in progress you will be prompted to clean files, click OK.

[*]Once the scan has completed, there will be a button located on the bottom of the screen named Save report.
  • Click Save report.
  • Save the report to your desktop.

[*]Reboot the computer to finish the removal process.

Step 2
Please download and install Ad-Aware SE Personal.

Install and Update Ad-Aware SE:
  • Download and Install Ad-Aware SE, keeping the default options. However, some of the settings will need to be changed before your first scan.
  • Close ALL windows except Ad-Aware SE.
  • Click on the‘world’ icon at the top right of the Ad-Aware SE window and let AdAware SE update the reference list for the adware and malware.
  • Once the update is finished, close the program.

Scanning with Ad-Aware SE:
  • Reboot into Safe Mode (tap F8 during bootup, use arrow keys to select Safe Mode, then hit 'enter').
  • Launch Ad-Aware again.
  • Click on the ‘Gear’ icon (second from the left at the top of the window) to access the preferences/settings window.
    • In the ‘General’ window make sure the following are selected in green:
      • Automatically save log-file
      • Automatically quarantine objects prior to removal
      • Safe Mode (always request confirmation)
    • Under Definitions:
      • Prompt to udate outdated definitions - set the number of days
    • Click on the ‘Scanning’ button on the left and select in green :
      • Under Driver, Folders & Files:
        • Scan Within Archives
      • Under Select drives & folders to scan -
        • choose all hard drives
      • Under Memory & Registry: all green
      • Scan active processes
      • Scan registry
      • Deep-scan registry
      • Scan my IE favorites for banned URLs
      • Scan my Hosts file
    • Click on the ‘Advanced’ button on the left and select in green:
      • Under Shell Integration:
        • Move deleted files to recycle bin
      • Under Logfile Detail Level: (all green)
        • include addtional object information
        • DESELECT - include negligible objects information
        • include environment information
      • Under Alternate Data Streams:
        • Don't log streams smaller than 0 bytes
        • Don't log ADS with the following names: CA_INOCULATEIT
    • Click the ‘Tweak’ button and select in green:
      • Under the ‘Scanning Engine’:
        • Unload recognized processes during scanning
        • Scan registry for all users instead of current user only
      • Under the ‘Cleaning Engine’:
        • Always try to unload modules before deletion
        • During removal, unload Explorer and IE if necessary
        • Let Windows remove files in use at next reboot
      • Under the Log Files:
        • Include basic Ad-aware SE settings in logfile
        • Include additional Ad-aware SE settings in logfile
        • Please do not check or make green: Include Module list in logfile
  • Click on ‘Proceed’ to save the settings.
  • Click ‘Start’
    • Choose:'Perform Full System Scan'
    • DESELECT "Search for negligible risk entries", as negligible risk entries (MRU's) are not considered to be a threat.
  • Click ‘Next’ and Ad-Aware SE will scan your hard drive(s) with the options you have selected and clean automatically.
  • If Ad-Aware SE finds bad entries, you will receive a list of what it found in the window.
  • Save the log file when it asks and then click ‘finish’.
  • REBOOT to complete the removal of what Ad-Aware SE found.
Step 3
Scan with HijackThis and post the fresh HijackThis log as a reply to this thread. Please turn off Word Wrap in Notepad before replying. (In Notepad, click Format and uncheck Word Wrap)
Post #6
Ok I did as you suggested. Here is the new log file

Logfile of HijackThis v1.99.1
Scan saved at 12:09:25 PM, on 6/24/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\McAfee\McAfee Privacy Service\GUARDDOG.EXE
C:\WINDOWS\System32\cisvc.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFSERVICE.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\McAfee\McAfee Privacy Service\GUARDDOG.EXE
C:\WINDOWS\System32\S3apphk.exe
C:\WINDOWS\essspk.exe
C:\Program Files\MSN Apps\Updater\01.03.0000.1005\en-us\msnappau.exe
C:\Program Files\Lexmark X5100 Series\lxbabmgr.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
C:\Program Files\Lexmark X5100 Series\lxbabmon.exe
C:\Program Files\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFTRAY.EXE
C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
C:\PROGRA~1\McAfee\SECURE~1\SIEPulse.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFAGENT.EXE
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\WINDOWS\System32\cidaemon.exe
C:\HiJackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.gophersearch.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.gophersearch.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.gophersearch.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.gophersearch.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.gophersearch.com/
R3 - Default URLSearchHook is missing
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Bruce\Application Data\Mozilla\Profiles\default\l4so0khp.slt\prefs.js)
O2 - BHO: ohb - {22DFEAE8-9AD2-4FC6-9CBA-A6566CA3B6EB} - C:\WINDOWS\System32\gpstool.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [S3apphk] S3apphk.exe
O4 - HKLM\..\Run: [EssSpkPhone] essspk.exe
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.03.0000.1005\en-us\msnappau.exe"
O4 - HKLM\..\Run: [Lexmark X5100 Series] "C:\Program Files\Lexmark X5100 Series\lxbabmgr.exe"
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [McAfee Guardian] C:\Program Files\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe /SU
O4 - HKLM\..\Run: [MCAgentExe] C:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [MSKDetectorExe] C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe /startup
O4 - HKLM\..\Run: [MPFTray] C:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFTRAY.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [SIE2004] "C:\PROGRA~1\McAfee\SECURE~1\SIEPulse.exe"
O4 - HKLM\..\Run: [SpybotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - HKLM\..\Run: [CleanUp] C:\PROGRA~1\McAfee.com\Shared\mcappins.exe /v=3 /cleanup
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: winlogin.exe
O4 - Global Startup: QuickBooks Update Agent.lnk.disabled
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe
O9 - Extra button: Privacy Bar - {cc4b2ee5-4803-11d7-8a38-00b0d0c6b814} - C:\Program Files\McAfee\McAfee Privacy Service\GDIEHELP.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O15 - Trusted Zone: createpdf.adobe.com
O15 - Trusted Zone: www.alexa.com
O15 - Trusted Zone: www.allthingscedar.com
O15 - Trusted Zone: www.amvona.com
O15 - Trusted Zone: www.andersonteak.com
O15 - Trusted Zone: www.grandrapids.bbb.org
O15 - Trusted Zone: www.bbbonline.org
O15 - Trusted Zone: www.brainyquote.com
O15 - Trusted Zone: www.centurytel.com
O15 - Trusted Zone: dslst.mx.centurytel.net
O15 - Trusted Zone: www.consumersenergy.com
O15 - Trusted Zone: www.countrycritter.com
O15 - Trusted Zone: securesite.cusiteonline.com
O15 - Trusted Zone: www.custom-teak.com
O15 - Trusted Zone: www.dreamsalivemagazine.com
O15 - Trusted Zone: www.duvera.com
O15 - Trusted Zone: www.easy-reciprocal-links.com
O15 - Trusted Zone: my.ebay.com
O15 - Trusted Zone: www.eci-pay.com
O15 - Trusted Zone: www.excaliburbrothers.com
O15 - Trusted Zone: www.find-information-on.com
O15 - Trusted Zone: www.furnado.com
O15 - Trusted Zone: *.furnitureshoppingtips.com
O15 - Trusted Zone: www.godaddy.com
O15 - Trusted Zone: www.howtogetanythingyouwant.com
O15 - Trusted Zone: www.instantinternetprofits.com
O15 - Trusted Zone: www.instantmarketingtoolbox.com
O15 - Trusted Zone: www.instantsalesletters.com
O15 - Trusted Zone: www.iwebtrack.com
O15 - Trusted Zone: *.java.com
O15 - Trusted Zone: *.jewelleryshopper.ca
O15 - Trusted Zone: www.kwmap.com
O15 - Trusted Zone: www.lochnesswatergardens.com
O15 - Trusted Zone: www.misbtdc.org
O15 - Trusted Zone: www.modguys.com
O15 - Trusted Zone: www.mplusgps.com
O15 - Trusted Zone: www.myownemail.com
O15 - Trusted Zone: www.nepalnet.net
O15 - Trusted Zone: www.netmechanic.com
O15 - Trusted Zone: *.outdoor-patio-furniture.biz
O15 - Trusted Zone: www.pioneer-michigan.com
O15 - Trusted Zone: www.rlrouse.com
O15 - Trusted Zone: *.searchenginewatch.com
O15 - Trusted Zone: *.secure-ss.com
O15 - Trusted Zone: www.sherrysellsseashells.com
O15 - Trusted Zone: myws.sitesell.com
O15 - Trusted Zone: www.sitesell.com
O15 - Trusted Zone: www.sitetube.com
O15 - Trusted Zone: www2.smcorp.com
O15 - Trusted Zone: www.storesonline.com
O15 - Trusted Zone: www.surefiremarketing.com
O15 - Trusted Zone: www.teakalook.com
O15 - Trusted Zone: www.thehungerinside.com
O15 - Trusted Zone: www.thomasregister.com
O15 - Trusted Zone: www.thosbaker.com
O15 - Trusted Zone: dir.thumbshots.net
O15 - Trusted Zone: www.trendmicro.com
O15 - Trusted Zone: *.vanbarniknakstuff.biz
O15 - Trusted Zone: www.vboutdoorteakfurniture.com
O15 - Trusted Zone: www.viking.com
O15 - Trusted Zone: www.vistaworks.com
O15 - Trusted Zone: www.walmart.com
O15 - Trusted Zone: www.wealthylegacy.com
O15 - Trusted Zone: www.westminsterteak.com
O15 - Trusted Zone: *.whois.sc
O15 - Trusted Zone: webmonkey.wired.com
O15 - Trusted Zone: www.worldwidebrands.com
O15 - Trusted Zone: www.yanikrecommends.com
O20 - AppInit_DLLs: jz95o1rujb2grgd.dll.dll.dll.dll.dll.dll.dll
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: McAfee Privacy Service (GuardDogEXE) - Unknown owner - C:\Program Files\McAfee\McAfee Privacy Service\GUARDDOG.EXE" /SERVICE (file missing)
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFSERVICE.exe
O23 - Service: McAfee SpamKiller Server (MskService) - Networks Associates Technology. Inc. - C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe

Thank you…Hopefully this is fixed…but if not or you see something let me know.
Post #7
Step 1
You have Spybot S&D's Teatimer running which is good, but we need you to disable it for the remainder of the fix as it will interfere with the registry changes being made.
Open Spybot S&D in advanced mode, click Tools > Resident, and remove the check from "Resident Tea-Timer". Reboot after unchecking the entry.

Be sure to re-enable this option again once the computer is clean.


Step 2
Open HijackThis, run a scan, then check the following:

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.gophersearch.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.gophersearch.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.gophersearch.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.gophersearch.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.gophersearch.com/
R3 - Default URLSearchHook is missing

O2 - BHO: ohb - {22DFEAE8-9AD2-4FC6-9CBA-A6566CA3B6EB} - C:\WINDOWS\System32\gpstool.dll

O4 - Global Startup: winlogin.exe

O15 - Trusted Zone: www.teakalook.com << Include any other 015 items that you did not place in the Trusted Zone of Internet Explorer.

O20 - AppInit_DLLs: jz95o1rujb2grgd.dll.dll.dll.dll.dll.dll.dll

With all other programs and browsers closed, click fix checked.


Step 3
Please set your computer to show all files.
  • Double-click My Computer.
  • Click the Tools menu, and then click Folder Options.
  • Click the View tab.
  • Clear "Hide file extensions for known file types."
  • Under the "Hidden files" folder, select "Show hidden files and folders."
  • Clear "Hide protected operating system files."
  • Click Apply, and then click OK.
You will need to reverse this process when all steps are done.


Step 4
Please delete the following files:

C:\WINDOWS\System32\jz95o1rujb2grgd.dll.dll.dll.dll.dll.dll.dll
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\winlogin.exe

If you have any problem deleting these items, reboot into Safe Mode (tap F8 during bootup, use arrow keys to select Safe Mode, then hit 'enter') and try again.


Step 5
Reboot into Safe Mode and run another scan with Ad-Aware SE.


Step 6
Reboot normally and scan with HijackThis. Post the new log as a reply to this thread.
Please let us know of any complications you had and how the computer is behaving.
Post #8
Alright, I did what you asked. Except I could not find one file. C:\WINDOWS\System32\jz95o1rujb2grgd.dll.dll.dll.dll.dll.dll.dll I looked and couldn't find it…even did a search for it. Let me know what I missed, please? Logfile of HijackThis v1.99.1 Scan saved at 3:21:48 PM, on 6/24/2005 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\McAfee\McAfee Privacy Service\GUARDDOG.EXE C:\WINDOWS\System32\cisvc.exe C:\Program Files\ewido\security suite\ewidoctrl.exe C:\Program Files\ewido\security suite\ewidoguard.exe c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe C:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFSERVICE.exe C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe C:\WINDOWS\System32\snmp.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\wdfmgr.exe C:\WINDOWS\System32\MsPMSPSv.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\fxssvc.exe c:\PROGRA~1\mcafee.com\vso\mcshield.exe C:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFAGENT.EXE C:\WINDOWS\Explorer.EXE C:\Program Files\McAfee\McAfee Privacy Service\GUARDDOG.EXE C:\PROGRA~1\mcafee.com\agent\mcagent.exe C:\WINDOWS\System32\S3apphk.exe C:\WINDOWS\essspk.exe C:\Program Files\MSN Apps\Updater\01.03.0000.1005\en-us\msnappau.exe C:\Program Files\Lexmark X5100 Series\lxbabmgr.exe C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe C:\Program Files\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe C:\Program Files\Lexmark X5100 Series\lxbabmon.exe C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe c:\progra~1\mcafee.com\vso\mcvsescn.exe C:\PROGRA~1\McAfee\SECURE~1\SIEPulse.exe C:\WINDOWS\System32\wuauclt.exe C:\Program Files\QuickTime\qttask.exe C:\HiJackThis\HijackThis.exe N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Bruce\Application Data\Mozilla\Profiles\default\l4so0khp.slt\prefs.js) O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [S3apphk] S3apphk.exe O4 - HKLM\..\Run: [EssSpkPhone] essspk.exe O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.03.0000.1005\en-us\msnappau.exe" O4 - HKLM\..\Run: [Lexmark X5100 Series] "C:\Program Files\Lexmark X5100 Series\lxbabmgr.exe" O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask O4 - HKLM\..\Run: [McAfee Guardian] C:\Program Files\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe /SU O4 - HKLM\..\Run: [MCAgentExe] C:\PROGRA~1\mcafee.com\agent\mcagent.exe O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe" O4 - HKLM\..\Run: [MSKDetectorExe] C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe /startup O4 - HKLM\..\Run: [MPFTray] C:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFTRAY.EXE O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe O4 - HKLM\..\Run: [SIE2004] "C:\PROGRA~1\McAfee\SECURE~1\SIEPulse.exe" O4 - HKLM\..\Run: [SpybotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe" O4 - Global Startup: QuickBooks Update Agent.lnk.disabled O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe O9 - Extra button: Privacy Bar - {cc4b2ee5-4803-11d7-8a38-00b0d0c6b814} - C:\Program Files\McAfee\McAfee Privacy Service\GDIEHELP.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll O15 - Trusted Zone: createpdf.adobe.com O15 - Trusted Zone: www.alexa.com O15 - Trusted Zone: www.allthingscedar.com O15 - Trusted Zone: www.amvona.com O15 - Trusted Zone: www.andersonteak.com O15 - Trusted Zone: www.grandrapids.bbb.org O15 - Trusted Zone: www.bbbonline.org O15 - Trusted Zone: www.brainyquote.com O15 - Trusted Zone: www.centurytel.com O15 - Trusted Zone: dslst.mx.centurytel.net O15 - Trusted Zone: www.consumersenergy.com O15 - Trusted Zone: www.countrycritter.com O15 - Trusted Zone: www.custom-teak.com O15 - Trusted Zone: www.dreamsalivemagazine.com O15 - Trusted Zone: www.duvera.com O15 - Trusted Zone: www.easy-reciprocal-links.com O15 - Trusted Zone: my.ebay.com O15 - Trusted Zone: www.eci-pay.com O15 - Trusted Zone: www.excaliburbrothers.com O15 - Trusted Zone: www.furnado.com O15 - Trusted Zone: www.godaddy.com O15 - Trusted Zone: www.iwebtrack.com O15 - Trusted Zone: www.kwmap.com O15 - Trusted Zone: www.lochnesswatergardens.com O15 - Trusted Zone: www.misbtdc.org O15 - Trusted Zone: www.mplusgps.com O15 - Trusted Zone: www.nepalnet.net O15 - Trusted Zone: www.netmechanic.com O15 - Trusted Zone: *.outdoor-patio-furniture.biz O15 - Trusted Zone: www.pioneer-michigan.com O15 - Trusted Zone: myws.sitesell.com O15 - Trusted Zone: www.sitesell.com O15 - Trusted Zone: www2.smcorp.com O15 - Trusted Zone: www.storesonline.com O15 - Trusted Zone: www.surefiremarketing.com O15 - Trusted Zone: www.teakalook.com O15 - Trusted Zone: www.thehungerinside.com O15 - Trusted Zone: www.thomasregister.com O15 - Trusted Zone: www.thosbaker.com O15 - Trusted Zone: www.trendmicro.com O15 - Trusted Zone: *.vanbarniknakstuff.biz O15 - Trusted Zone: www.vboutdoorteakfurniture.com O15 - Trusted Zone: www.viking.com O15 - Trusted Zone: www.vistaworks.com O15 - Trusted Zone: www.walmart.com O15 - Trusted Zone: www.wealthylegacy.com O15 - Trusted Zone: www.westminsterteak.com O15 - Trusted Zone: *.whois.sc O15 - Trusted Zone: www.worldwidebrands.com O15 - Trusted Zone: www.yanikrecommends.com O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe O23 - Service: McAfee Privacy Service (GuardDogEXE) - Unknown owner - C:\Program Files\McAfee\McAfee Privacy Service\GUARDDOG.EXE" /SERVICE (file missing) O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFSERVICE.exe O23 - Service: McAfee SpamKiller Server (MskService) - Networks Associates Technology. Inc. - C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe You have no idea how much I appreciate this. Yes I will donate soon…really I will!
Post #10
The only signs so far is, on some web pages I get links on words such as date…goes to some dating site. loveseat the word love is a link to some porn site…no I don't click on them. :P I did do a virus scan with McAfee and it came up with a 'generic trojan' , it did clean those. Some icons have popped up on my desktop but I deleted them and they haven't returned yet. So I don't know if I am just cleaning up the reminants or what but for the most part it seems to be almost back to normal. So again I do thank you for all the help so far and I hope this will be all the help I need, for this round! LOL
Post #11
Sounds like there is still nothing not quite right.

Download CCleaner from here to clean temp files from your computer.
  • Double click on the file to start the installation of the program.
  • Select your language and click OK, then next.
  • Read the license agreement and click I Agree.
  • Click next to use the default install location. Click Install then finish to complete installation.
  • Double click the CCleaner shortcut on the desktop to start the program.
  • Click Options < Advanced and uncheck "Only delete files in Windows Temp folders older than 48 hours".
  • Click Run Cleaner to run the program.
  • After it has completed it's process, click Exit.
Caution : It is not recommended to use the 'Issues' tab as it is known to find legitimate items.

Click here to download mwavscan.
  • Double-click it to run it.
  • Read then accept the agreement.
  • Check Drive, and select all local drives, scan all files, then press 'scan'. (This may take a while and will not fix anything)
  • Once it finds something, it will prompt you so click OK.
  • When it is completed, anything found will be displayed in the lower pane.
  • Highlight it, copy it (CTRL+C), and paste (CTRL+V) it in your next reply.
Note : It will find many orphaned registry entries so please do not be alarmed by the amount of items that show.


Post the mwavscan log and a fresh HijackThis log.
Post #12
Ok here we go, Object "AltNet Spyware/Adware" found in File System! Action Taken: No Action Taken. Object "CWS.winproc32 Spyware/Adware" found in File System! Action Taken: No Action Taken. Object "iSearch Spyware/Adware" found in File System! Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\MediaAccX.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\MediaTicketsInstaller.ocx". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\System32\objsafe.tlb". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\System32\siq.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Common Files\Roxio Shared\DLLShared". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\System32\siq.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\System32\BSZIP.DLL". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\System32\pxwma.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\System32\pxinsa64.exe". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\System32\pxinsi64.exe". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\System32\pxcpya64.exe". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\System32\pxcpyi64.exe". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Adobe\Photoshop Elements 3.0\Famgr.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Adobe\Photoshop Elements 3.0\Asn.er.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\Downloaded Program Files\MediaTicketsInstaller.ocx". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\System32\objsafe.tlb". Action Taken: No Action Taken. Entry "HKCR\CLSID\{03C512E0-0444-11D2-9A7F-0000E8A2F1D2}" refers to invalid object "C:\Program Files\Common Files\Ulead Systems\Filters\MCutList.ax". Action Taken: No Action Taken. Entry "HKCR\CLSID\{0D2C959E-BA6A-4BBA-97AD-5BCA3F416F4D}" refers to invalid object "C:\WINDOWS\System32\gpstool.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{0FEF3B83-A208-45E6-8448-CEACEECA7C00}" refers to invalid object "C:\Program Files\Ulead Systems\Ulead COOL 360\PanoViewer.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{12CB5A72-9CBD-4C3C-999D-140C5D196068}" refers to invalid object "C:\WINDOWS\System32\gpstool.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{1440AD10-6AA8-11D1-B6F9-00A024DDAFD1}" refers to invalid object "C:\Westwood\RA2\blowfish.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{1E951F23-9C37-11D3-BA52-0000E8497C01}" refers to invalid object "C:\Program Files\Common Files\Ulead Systems\Filters\Dvsf.ax". Action Taken: No Action Taken. Entry "HKCR\CLSID\{1EFD6A40-3999-11CF-9150-00AA0059F70D}" refers to invalid object "F:\PROGRAM\32\mci32.ocx". Action Taken: No Action Taken. Entry "HKCR\CLSID\{349D777D-F7A2-4AAE-967F-A54F05A7FF3B}" refers to invalid object "C:\Program Files\Common Files\Intuit\QuickBooks\QBFinder.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{3775D2E0-7C5D-11CF-899E-00AA00688B10}" refers to invalid object "F:\PROGRAM\32\mci32.ocx". Action Taken: No Action Taken. Entry "HKCR\CLSID\{39AEA79A-BF43-475F-B4F9-15347CFBF2B3}" refers to invalid object "C:\Program Files\Common Files\Ulead Systems\Filters\Dvsf.ax". Action Taken: No Action Taken. Entry "HKCR\CLSID\{3D1EB621-38A1-11D4-AB8F-0000E875BA48}" refers to invalid object "C:\Program Files\Common Files\Ulead Systems\Filters\Dvsf.ax". Action Taken: No Action Taken. Entry "HKCR\CLSID\{40D41A8B-D79B-43d7-99A7-9EE0F344C385}" refers to invalid object "C:\Program Files\AIM Toolbar\AIMBar.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{4281B857-D41F-4165-B9E6-BE3DD5B24109}" refers to invalid object "C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRDrv.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{442D12A1-2641-11d2-90FB-006008A1F441}" refers to invalid object "a3d.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{46A06300-914A-11D3-BA52-0000E8497C01}" refers to invalid object "C:\Program Files\Common Files\Ulead Systems\Filters\Dvsf.ax". Action Taken: No Action Taken. Entry "HKCR\CLSID\{46A06303-914A-11D3-BA52-0000E8497C01}" refers to invalid object "C:\Program Files\Common Files\Ulead Systems\Filters\Dvsf.ax". Action Taken: No Action Taken. Entry "HKCR\CLSID\{4C171D40-8277-11D5-AD55-00010333D0AD}" refers to invalid object "C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{4DBC1640-F95A-11D1-9A7F-0000E8A2F1D2}" refers to invalid object "C:\Program Files\Common Files\Ulead Systems\Filters\MCutList.ax". Action Taken: No Action Taken. Entry "HKCR\CLSID\{61CAAD5D-29B6-4207-A3AA-E9AFEDA8510C}" refers to invalid object "C:\Program Files\Common Files\Ulead Systems\DVD\NTICdDrv.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{70DC80A9-D4F8-4383-A0D7-93179AA8305E}" refers to invalid object "C:\Program Files\Common Files\Ulead Systems\DVD\LdvdEng.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{7630D6A2-4512-4ca2-915D-F457BC782564}" refers to invalid object "C:\Program Files\Common Files\Ulead Systems\DVD\LdvdEng.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{7F5928C4-11B5-11D5-A62F-0010B5549630}" refers to invalid object "C:\Program Files\Common Files\Ulead Systems\Filters\UlCGMSDUMP.ax". Action Taken: No Action Taken. Entry "HKCR\CLSID\{88E729D6-BDC1-11D1-BD2A-00C04FB9603F}" refers to invalid object "fde.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{92FA2C24-253C-11d2-90FB-006008A1F441}" refers to invalid object "a3dapi.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{99180163-DA16-101A-935C-444553540000}" refers to invalid object "recncl.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{99AC5564-0CF3-4c5b-A594-651AC625DE15}" refers to invalid object "C:\Program Files\Common Files\Ulead Systems\DVD\LdvdEng.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{9F179100-F940-11D1-9A7F-0000E8A2F1D2}" refers to invalid object "C:\Program Files\Common Files\Ulead Systems\Filters\MCutList.ax". Action Taken: No Action Taken. Entry "HKCR\CLSID\{B0693766-5278-4ec6-B9E1-3CE40560EF5A}" refers to invalid object "CaPlgin.ax". Action Taken: No Action Taken. Entry "HKCR\CLSID\{B45A4A81-86DA-11D1-B706-00A024DDAFD1}" refers to invalid object "C:\Westwood\RA2\game.exe". Action Taken: No Action Taken. Entry "HKCR\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA3}" refers to invalid object "F:\PROGRAM\32\mci32.ocx". Action Taken: No Action Taken. Entry "HKCR\CLSID\{C2316705-49F3-46a6-B178-FD617FA235D8}" refers to invalid object "C:\Program Files\Common Files\Ulead Systems\DVD\LdvdEng.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{CF957F20-77FE-4192-A59F-95CA43BD04BA}" refers to invalid object "C:\Program Files\Common Files\Ulead Systems\MPEG\ulspmpeg.ax". Action Taken: No Action Taken. Entry "HKCR\CLSID\{CF957F28-77FE-4192-A59F-95CA43BD04BA}" refers to invalid object "C:\Program Files\Common Files\Ulead Systems\MPEG\ulspmpeg.ax". Action Taken: No Action Taken. Entry "HKCR\CLSID\{CF957F30-77FE-4192-A59F-95CA43BD04BA}" refers to invalid object "C:\Program Files\Common Files\Ulead Systems\MPEG\uldsmpeg.ax". Action Taken: No Action Taken. Entry "HKCR\CLSID\{CF957F38-77FE-4192-A59F-95CA43BD04BA}" refers to invalid object "C:\Program Files\Common Files\Ulead Systems\MPEG\uldsmpeg.ax". Action Taken: No Action Taken. Entry "HKCR\CLSID\{CF957F40-77FE-4192-A59F-95CA43BD04BA}" refers to invalid object "C:\Program Files\Common Files\Ulead Systems\MPEG\uldsmpeg.ax". Action Taken: No Action Taken. Entry "HKCR\CLSID\{CF957F48-77FE-4192-A59F-95CA43BD04BA}" refers to invalid object "C:\Program Files\Common Files\Ulead Systems\MPEG\uldsmpeg.ax". Action Taken: No Action Taken. Entry "HKCR\CLSID\{CF957F50-77FE-4192-A59F-95CA43BD04BA}" refers to invalid object "C:\Program Files\Common Files\Ulead Systems\MPEG\ulesmpeg.ax". Action Taken: No Action Taken. Entry "HKCR\CLSID\{CF957F58-77FE-4192-A59F-95CA43BD04BA}" refers to invalid object "C:\Program Files\Common Files\Ulead Systems\MPEG\ulesmpeg.ax". Action Taken: No Action Taken. Entry "HKCR\CLSID\{CF957F59-77FE-4192-A59F-95CA43BD04BA}" refers to invalid object "C:\Program Files\Common Files\Ulead Systems\MPEG\ulesmpeg.ax". Action Taken: No Action Taken. Entry "HKCR\CLSID\{CF957F5B-77FE-4192-A59F-95CA43BD04BA}" refers to invalid object "C:\Program Files\Common Files\Ulead Systems\MPEG\ulesmpeg.ax". Action Taken: No Action Taken. Entry "HKCR\CLSID\{D70E6A20-7060-4829-B3D7-B6624A1DE7C6}" refers to invalid object "C:\Program Files\AIM Toolbar\aimhelper.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{D7A7442D-85A9-475F-82F9-65ED4110B4C5}" refers to invalid object "C:\WINDOWS\System32\gpstool.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{d8f1eee0-f634-11cf-8700-00a0245d918b}" refers to invalid object "a3d.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{E7563EE0-F93F-11D1-9A7F-0000E8A2F1D2}" refers to invalid object "C:\Program Files\Common Files\Ulead Systems\Filters\MCutList.ax". Action Taken: No Action Taken. Entry "HKCR\ComPlusMetaData.MsCorHost" refers to invalid object "{727CDF4F-3BA0-11D3-8738-00C04F79ED0D}". Action Taken: No Action Taken. Entry "HKCR\ComPlusMetaData.MsCorHost.2" refers to invalid object "{727CDF4F-3BA0-11D3-8738-00C04F79ED0D}". Action Taken: No Action Taken. Entry "HKCR\PDF.PdfCtrl.6" refers to invalid object "{CA8A9780-280D-11CF-A24D-444553540000}". Action Taken: No Action Taken. Entry "HKCR\PE2.BasicEditing" refers to invalid object "{ED88DAF1-BA55-11D0-9620-0080C81859FE}". Action Taken: No Action Taken. Entry "HKCR\PE2.BnC" refers to invalid object "{0B796E76-BA4D-11D0-9617-0080C81859FE}". Action Taken: No Action Taken. Entry "HKCR\PE2.ClrBaln" refers to invalid object "{0B796E76-BA4D-11D0-9617-0080C81859FE}". Action Taken: No Action Taken. Entry "HKCR\PE2.Crop" refers to invalid object "{B5CE2CD5-C0A1-11D0-9617-0080C81859FE}". Action Taken: No Action Taken. Entry "HKCR\PE2.Rotate" refers to invalid object "{ACA339B5-189F-11D1-A838-0080C81F572B}". Action Taken: No Action Taken. Entry "HKCR\Plenoptic.Plenoptic" refers to invalid object "{607C27E9-AB27-11d3-A116-A0EA50C10801}". Action Taken: No Action Taken. Entry "HKCR\Plenoptic.Plenoptic.1" refers to invalid object "{607C27E9-AB27-11d3-A116-A0EA50C10801}". Action Taken: No Action Taken. Entry "HKCR\SymWriter.pdb" refers to invalid object "{520DC67A-752E-11D3-8D56-00C04F680B2B}". Action Taken: No Action Taken. Entry "HKCR\WMPPublsihCntr.WMPPublsihCntr" refers to invalid object "{939438A9-CF0F-44d8-9140-599736F0D3A2}". Action Taken: No Action Taken. Entry "HKCR\WMPPublsihCntr.WMPPublsihCntr.1" refers to invalid object "{939438A9-CF0F-44d8-9140-599736F0D3A2}". Action Taken: No Action Taken. Entry "HKCR\WMSServer.Server" refers to invalid object "{845FB959-4279-11D2-BF23-00805FBE84A6}". Action Taken: No Action Taken. Entry "HKCR\WMSServer.Server.9" refers to invalid object "{845FB959-4279-11D2-BF23-00805FBE84A6}". Action Taken: No Action Taken. File C:\WINDOWS\System32\rk.exe tagged as not-a-virus:Server-Proxy.Win32.MarketScore.i. No Action Taken. File C:\WINDOWS\System32\eaffiliate2.exe infected by "Trojan-Downloader.Win32.TSUpdate.e" Virus! Action Taken: No Action Taken. File C:\WINDOWS\System32\Iftvmk38wbr.dll infected by "Trojan-Dropper.Win32.Small.xm" Virus! Action Taken: No Action Taken. Now for the HiJack This log Logfile of HijackThis v1.99.1 Scan saved at 11:49:03 AM, on 6/25/2005 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\cisvc.exe C:\Program Files\ewido\security suite\ewidoctrl.exe c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe C:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFSERVICE.exe C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe C:\WINDOWS\System32\snmp.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\wdfmgr.exe C:\WINDOWS\System32\MsPMSPSv.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\fxssvc.exe c:\PROGRA~1\mcafee.com\vso\mcshield.exe C:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFAGENT.EXE C:\WINDOWS\Explorer.EXE C:\PROGRA~1\mcafee.com\agent\mcagent.exe C:\WINDOWS\System32\S3apphk.exe C:\WINDOWS\essspk.exe C:\Program Files\MSN Apps\Updater\01.03.0000.1005\en-us\msnappau.exe C:\Program Files\Lexmark X5100 Series\lxbabmgr.exe C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe C:\Program Files\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe C:\Program Files\Lexmark X5100 Series\lxbabmon.exe C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe c:\progra~1\mcafee.com\vso\mcvsescn.exe C:\PROGRA~1\McAfee\SECURE~1\SIEPulse.exe C:\Program Files\QuickTime\qttask.exe C:\WINDOWS\System32\cidaemon.exe C:\PROGRA~1\AIM\aim.exe c:\progra~1\mcafee.com\vso\mcvsftsn.exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\S3apphk.exe C:\WINDOWS\essspk.exe C:\Program Files\MSN Apps\Updater\01.03.0000.1005\en-us\msnappau.exe C:\Program Files\Lexmark X5100 Series\lxbabmgr.exe C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe C:\Program Files\Lexmark X5100 Series\lxbabmon.exe C:\Program Files\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe C:\PROGRA~1\mcafee.com\agent\mcagent.exe C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe c:\progra~1\mcafee.com\vso\mcvsescn.exe C:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFTRAY.EXE C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe C:\PROGRA~1\McAfee\SECURE~1\SIEPulse.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\TrojanHunter 4.2\THGuard.exe C:\PROGRA~1\AIM\aim.exe C:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFAGENT.EXE C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe c:\progra~1\mcafee.com\vso\mcvsftsn.exe C:\Program Files\Messenger\msmsgs.exe C:\PROGRA~1\THEWEA~1\DESKTO~1\DESKTO~1.EXE C:\Program Files\ewido\security suite\ewidoguard.exe C:\Program Files\Zeus\Zeus.exe C:\WINDOWS\System32\wisptis.exe C:\PROGRA~1\NETSCAPE\NETSCAPE\NETSCP.EXE C:\HiJackThis\HijackThis.exe N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Bruce\Application Data\Mozilla\Profiles\default\l4so0khp.slt\prefs.js) O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [S3apphk] S3apphk.exe O4 - HKLM\..\Run: [EssSpkPhone] essspk.exe O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.03.0000.1005\en-us\msnappau.exe" O4 - HKLM\..\Run: [Lexmark X5100 Series] "C:\Program Files\Lexmark X5100 Series\lxbabmgr.exe" O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask O4 - HKLM\..\Run: [McAfee Guardian] C:\Program Files\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe /SU O4 - HKLM\..\Run: [MCAgentExe] C:\PROGRA~1\mcafee.com\agent\mcagent.exe O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe" O4 - HKLM\..\Run: [MSKDetectorExe] C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe /startup O4 - HKLM\..\Run: [MPFTray] C:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFTRAY.EXE O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe O4 - HKLM\..\Run: [SIE2004] "C:\PROGRA~1\McAfee\SECURE~1\SIEPulse.exe" O4 - HKLM\..\Run: [SpybotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe" O4 - HKLM\..\Run: [McRegWiz] C:\PROGRA~1\McAfee.com\Agent\McRegWiz.exe /autorun O4 - Global Startup: QuickBooks Update Agent.lnk.disabled O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe O9 - Extra button: Privacy Bar - {cc4b2ee5-4803-11d7-8a38-00b0d0c6b814} - C:\Program Files\McAfee\McAfee Privacy Service\GDIEHELP.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll O15 - Trusted Zone: createpdf.adobe.com O15 - Trusted Zone: www.alexa.com O15 - Trusted Zone: www.allthingscedar.com O15 - Trusted Zone: www.amvona.com O15 - Trusted Zone: www.andersonteak.com O15 - Trusted Zone: www.grandrapids.bbb.org O15 - Trusted Zone: www.bbbonline.org O15 - Trusted Zone: www.brainyquote.com O15 - Trusted Zone: www.centurytel.com O15 - Trusted Zone: dslst.mx.centurytel.net O15 - Trusted Zone: www.consumersenergy.com O15 - Trusted Zone: www.countrycritter.com O15 - Trusted Zone: www.custom-teak.com O15 - Trusted Zone: www.dreamsalivemagazine.com O15 - Trusted Zone: www.duvera.com O15 - Trusted Zone: www.easy-reciprocal-links.com O15 - Trusted Zone: my.ebay.com O15 - Trusted Zone: www.eci-pay.com O15 - Trusted Zone: www.excaliburbrothers.com O15 - Trusted Zone: www.furnado.com O15 - Trusted Zone: www.godaddy.com O15 - Trusted Zone: www.iwebtrack.com O15 - Trusted Zone: www.kwmap.com O15 - Trusted Zone: www.lochnesswatergardens.com O15 - Trusted Zone: www.misbtdc.org O15 - Trusted Zone: www.mplusgps.com O15 - Trusted Zone: www.nepalnet.net O15 - Trusted Zone: www.netmechanic.com O15 - Trusted Zone: *.outdoor-patio-furniture.biz O15 - Trusted Zone: www.pioneer-michigan.com O15 - Trusted Zone: myws.sitesell.com O15 - Trusted Zone: www.sitesell.com O15 - Trusted Zone: www2.smcorp.com O15 - Trusted Zone: www.storesonline.com O15 - Trusted Zone: www.surefiremarketing.com O15 - Trusted Zone: www.teakalook.com O15 - Trusted Zone: www.thehungerinside.com O15 - Trusted Zone: www.thomasregister.com O15 - Trusted Zone: www.thosbaker.com O15 - Trusted Zone: www.trendmicro.com O15 - Trusted Zone: *.vanbarniknakstuff.biz O15 - Trusted Zone: www.vboutdoorteakfurniture.com O15 - Trusted Zone: www.viking.com O15 - Trusted Zone: www.vistaworks.com O15 - Trusted Zone: www.walmart.com O15 - Trusted Zone: www.wealthylegacy.com O15 - Trusted Zone: www.westminsterteak.com O15 - Trusted Zone: *.whois.sc O15 - Trusted Zone: www.worldwidebrands.com O15 - Trusted Zone: www.yanikrecommends.com O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe O23 - Service: McAfee Privacy Service (GuardDogEXE) - Unknown owner - C:\Program Files\McAfee\McAfee Privacy Service\GUARDDOG.EXE" /SERVICE (file missing) O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFSERVICE.exe O23 - Service: McAfee SpamKiller Server (MskService) - Networks Associates Technology. Inc. - C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
Post #13
Step 1
Please set your computer to show all files.
  • Double-click My Computer.
  • Click the Tools menu, and then click Folder Options.
  • Click the View tab.
  • Clear "Hide file extensions for known file types."
  • Under the "Hidden files" folder, select "Show hidden files and folders."
  • Clear "Hide protected operating system files."
  • Click Apply, and then click OK.
You will need to reverse this process when all steps are done.


Step 2
Please delete the following files/folders:

C:\WINDOWS\System32\rk.exe
C:\WINDOWS\System32\eaffiliate2.exe
C:\WINDOWS\System32\Iftvmk38wbr.dll

If you have any problem deleting these items, reboot into Safe Mode (tap F8 during bootup, use arrow keys to select Safe Mode, then hit 'enter') and try again.


Step 3
Reboot normally and scan with HijackThis. Post the new log as a reply to this thread.
Let us know how the computer is working now.
Post #14
Logfile of HijackThis v1.99.1 Scan saved at 3:18:49 PM, on 6/27/2005 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\Program Files\McAfee\McAfee Privacy Service\GUARDDOG.EXE C:\WINDOWS\System32\cisvc.exe C:\Program Files\ewido\security suite\ewidoctrl.exe C:\Program Files\ewido\security suite\ewidoguard.exe c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe C:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFSERVICE.exe C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe C:\WINDOWS\System32\snmp.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\wdfmgr.exe C:\WINDOWS\System32\MsPMSPSv.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\fxssvc.exe c:\PROGRA~1\mcafee.com\vso\mcshield.exe C:\WINDOWS\Explorer.EXE C:\Program Files\McAfee\McAfee Privacy Service\GUARDDOG.EXE C:\WINDOWS\System32\S3apphk.exe C:\WINDOWS\essspk.exe C:\Program Files\MSN Apps\Updater\01.03.0000.1005\en-us\msnappau.exe C:\Program Files\Lexmark X5100 Series\lxbabmgr.exe C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe C:\Program Files\Lexmark X5100 Series\lxbabmon.exe C:\Program Files\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe C:\PROGRA~1\mcafee.com\agent\mcagent.exe C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe c:\progra~1\mcafee.com\vso\mcvsescn.exe C:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFTRAY.EXE C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe C:\PROGRA~1\McAfee\SECURE~1\SIEPulse.exe C:\Program Files\QuickTime\qttask.exe C:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFAGENT.EXE C:\WINDOWS\System32\cidaemon.exe C:\HiJackThis\HijackThis.exe C:\Program Files\Outlook Express\msimn.exe N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Bruce\Application Data\Mozilla\Profiles\default\l4so0khp.slt\prefs.js) O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [S3apphk] S3apphk.exe O4 - HKLM\..\Run: [EssSpkPhone] essspk.exe O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.03.0000.1005\en-us\msnappau.exe" O4 - HKLM\..\Run: [Lexmark X5100 Series] "C:\Program Files\Lexmark X5100 Series\lxbabmgr.exe" O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask O4 - HKLM\..\Run: [McAfee Guardian] C:\Program Files\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe /SU O4 - HKLM\..\Run: [MCAgentExe] C:\PROGRA~1\mcafee.com\agent\mcagent.exe O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe" O4 - HKLM\..\Run: [MSKDetectorExe] C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe /startup O4 - HKLM\..\Run: [MPFTray] C:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFTRAY.EXE O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe O4 - HKLM\..\Run: [SIE2004] "C:\PROGRA~1\McAfee\SECURE~1\SIEPulse.exe" O4 - HKLM\..\Run: [SpybotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe" O4 - Global Startup: QuickBooks Update Agent.lnk.disabled O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe O9 - Extra button: Privacy Bar - {cc4b2ee5-4803-11d7-8a38-00b0d0c6b814} - C:\Program Files\McAfee\McAfee Privacy Service\GDIEHELP.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll O15 - Trusted Zone: createpdf.adobe.com O15 - Trusted Zone: www.alexa.com O15 - Trusted Zone: www.allthingscedar.com O15 - Trusted Zone: www.amvona.com O15 - Trusted Zone: www.andersonteak.com O15 - Trusted Zone: www.grandrapids.bbb.org O15 - Trusted Zone: www.bbbonline.org O15 - Trusted Zone: www.brainyquote.com O15 - Trusted Zone: www.centurytel.com O15 - Trusted Zone: dslst.mx.centurytel.net O15 - Trusted Zone: www.consumersenergy.com O15 - Trusted Zone: www.countrycritter.com O15 - Trusted Zone: www.custom-teak.com O15 - Trusted Zone: www.dreamsalivemagazine.com O15 - Trusted Zone: www.duvera.com O15 - Trusted Zone: www.easy-reciprocal-links.com O15 - Trusted Zone: my.ebay.com O15 - Trusted Zone: www.eci-pay.com O15 - Trusted Zone: www.excaliburbrothers.com O15 - Trusted Zone: www.furnado.com O15 - Trusted Zone: www.godaddy.com O15 - Trusted Zone: www.iwebtrack.com O15 - Trusted Zone: www.kwmap.com O15 - Trusted Zone: www.lochnesswatergardens.com O15 - Trusted Zone: www.misbtdc.org O15 - Trusted Zone: www.mplusgps.com O15 - Trusted Zone: www.nepalnet.net O15 - Trusted Zone: www.netmechanic.com O15 - Trusted Zone: *.outdoor-patio-furniture.biz O15 - Trusted Zone: www.pioneer-michigan.com O15 - Trusted Zone: myws.sitesell.com O15 - Trusted Zone: www.sitesell.com O15 - Trusted Zone: www2.smcorp.com O15 - Trusted Zone: www.storesonline.com O15 - Trusted Zone: www.surefiremarketing.com O15 - Trusted Zone: www.teakalook.com O15 - Trusted Zone: www.thehungerinside.com O15 - Trusted Zone: www.thomasregister.com O15 - Trusted Zone: www.thosbaker.com O15 - Trusted Zone: www.trendmicro.com O15 - Trusted Zone: *.vanbarniknakstuff.biz O15 - Trusted Zone: www.vboutdoorteakfurniture.com O15 - Trusted Zone: www.viking.com O15 - Trusted Zone: www.vistaworks.com O15 - Trusted Zone: www.walmart.com O15 - Trusted Zone: www.wealthylegacy.com O15 - Trusted Zone: www.westminsterteak.com O15 - Trusted Zone: *.whois.sc O15 - Trusted Zone: www.worldwidebrands.com O15 - Trusted Zone: www.yanikrecommends.com O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe O23 - Service: McAfee Privacy Service (GuardDogEXE) - Unknown owner - C:\Program Files\McAfee\McAfee Privacy Service\GUARDDOG.EXE" /SERVICE (file missing) O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFSERVICE.exe O23 - Service: McAfee SpamKiller Server (MskService) - Networks Associates Technology. Inc. - C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe I believe it is all gone now…no more unkown links, and I don't see anything that is remaining…but if you see something…let me know. I realy appreciate this. :D
Post #15
Log looks great. :thumbup:

I still recommend removing all sites from your Trusted Zone in Internet Explorer as it is not necessary to have them there for them to work and it gives them easier access to your computer.

www.alexa.com << This one in particular is listed in IE-Spyad and MVPS Hosts as being bad.


Reset and Re-enable your System Restore to remove bad files that have been backed up by Windows. The files in System Restore are protected to prevent any programs changing those files. This is the only way to clean these files: (You will lose all previous restore points which are likely to be infected.)

1. Right-click My Computer, and then click Properties.
2. On the System Restore tab, put a check mark in the 'Turn Off System Restore' check box.
3. Click OK, and then click Yes.
4. Restart the computer.
5. Repeat steps 1 - 2, this time clearing the box beside 'Turn Off System Restore', click 'OK'.


I suggest that you get these programs to help keep the computer clean:

Spyware Blaster - Blocks bad ActiveX items from installing on your computer. Spyware Blaster runs silently in the background.
SpywareGuard - Real-time protection from spyware installation attempts
ie-spyad - Puts over 8,000 bad URLs into your restricted sites for Internet Explorer.
Firefox - 'Safer' alternative to the Internet Explorer web browser.

AVG AntiVirus - Free antivirus program if you currently are not using one.
ZoneAlarm - Free firewall program if you currently are not using one.

Update these regularly.

You may also want to read "How did I get infected in the first place" to learn how to better secure your computer.

Be sure to keep Windows and your Anti-virus updated.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI