Spyware / Malware / Virus Removal

15/ 6 / 05 and no reply HELP please

4 min read

Looking for the outcome? Ask AI

abcnightmare Topic Starter

Post #1June 15, 2005, 7:29 PM UTC

Please help my browser has been hijacked and I cannot shift it with norton spy doctor pest patrol………. all in safe mode…….. this one is bad

abcnightmare

Post #2June 15, 2005, 7:32 PM UTC last edited June 15, 2005, 8:13 PM UTC

Please help
my browser has been hijacked and I cannot shift it with norton spy doctor pest patrol………. all in safe mode…….. this one is bad
ok heres the log ..
Logfile of HijackThis v1.99.1
Scan saved at 21:09:00, on 15/06/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Executive Software\Diskeeper\DkService.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\EPoX\USDM\USDM.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\System32\CTHELPER.EXE
C:\Program Files\Creative\SBAudigy\AudioHQ\AHQTBU.EXE
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
C:\PROGRA~1\PESTPA~1\PPControl.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb10.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Google\Gmail Notifier\gnotify.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\windows\mqesraf.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Ade\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://abcsearch4u.com/sp.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://abcsearch4u.com/index.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://abcsearch4u.com/index.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://abcsearch4u.com/sp.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://abcsearch4u.com/index.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\about.htm
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: Norton Internet Security - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [EPoXUSDM] "C:\Program Files\EPoX\USDM\USDM.EXE" "5000"
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [CTStartup] C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE /run
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [AudioHQU] C:\Program Files\Creative\SBAudigy\AudioHQ\AHQTBU.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Executive Software\Diskeeper\DkIcon.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [PestPatrol Control Center] C:\PROGRA~1\PESTPA~1\PPControl.exe
O4 - HKLM\..\Run: [RemoteControl] C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
O4 - HKLM\..\Run: [PPMemCheck] C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
O4 - HKLM\..\Run: [CookiePatrol] C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb10.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [ImInstaller_IncrediMail] C:\DOCUME~1\Alex\LOCALS~1\Temp\ImInstaller\IncrediMail\imloader.exe -startup -product IncrediMail
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [wddmmcn] c:\windows\mqesraf.exe
O4 - HKCU\..\Run: [moxfphi] c:\windows\mqesraf.exe
O4 - HKCU\..\Run: [pwgsfsj] c:\windows\mqesraf.exe
O4 - HKCU\..\Run: [ifhhewh] c:\windows\mqesraf.exe
O4 - HKCU\..\Run: [ltnnxly] c:\windows\mqesraf.exe
O4 - HKCU\..\Run: [hbrcuyo] c:\windows\mqesraf.exe
O4 - HKCU\..\Run: [elhkkik] c:\windows\mqesraf.exe
O4 - HKCU\..\Run: [jojuoql] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [tqyiovp] c:\windows\acklyux.exe
O4 - HKCU\..\Run: [bsgevth] c:\windows\ajvhptt.exe
O4 - HKCU\..\Run: [qdeqkss] c:\windows\acklyux.exe
O4 - HKCU\..\Run: [cofbgfx] c:\windows\ajvhptt.exe
O4 - HKCU\..\Run: [oilsbcf] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [daxwpbk] c:\windows\acklyux.exe
O4 - HKCU\..\Run: [pvdstwt] c:\windows\ajvhptt.exe
O4 - HKCU\..\Run: [citesto] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [nnymykc] c:\windows\acklyux.exe
O4 - HKCU\..\Run: [ckjpuji] c:\windows\ajvhptt.exe
O4 - HKCU\..\Run: [wehrafj] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [abpvmmm] c:\windows\acklyux.exe
O4 - HKCU\..\Run: [ajydqox] c:\windows\ajvhptt.exe
O4 - HKCU\..\Run: [fsjgqxo] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [evfleak] c:\windows\acklyux.exe
O4 - HKCU\..\Run: [wipvmpf] c:\windows\ajvhptt.exe
O4 - HKCU\..\Run: [jkvyhgt] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [mxonxjy] c:\windows\acklyux.exe
O4 - HKCU\..\Run: [ouvpquf] c:\windows\ajvhptt.exe
O4 - HKCU\..\Run: [eybamwt] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [kcxqfpe] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [gakhfes] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [upnwkna] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [cnnjyql] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [skjctmc] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [ivltpsk] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [xfceots] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [omhklla] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [eqbvjnt] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [ctmckit] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [pdqvkxo] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [svejgau] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [axgxowi] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [ydrnyug] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [otnlyvg] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [uwaasyr] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [gnpcvav] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [cafgssw] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [londovh] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [irfpdjh] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [ttlskct] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [hoisyyv] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [pukvtnd] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [wacfmsq] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [epjfexg] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [xaaqvpv] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [dfjriju] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [ewkvsjn] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [rfnaqpt] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [ybjjfno] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [ptlwcki] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [shrqkhv] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [ewfbadl] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [rwaypac] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [jfxdaya] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [guudvue] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [bqcnxcn] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [ynpjhph] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [fwwryjd] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [dmgixie] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [etvopkt] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [uteraqk] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [gilpvpc] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [pgsxyux] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [vspamax] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [rtqiaaj] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [eamyiyd] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [rwloyso] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [rrfummf] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [dsefbwf] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [vatxxsm] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [clsxdpm] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [qhtgtvq] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [xotvhgr] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [msobyac] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [cehafra] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [wicxrcp] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [vsmqcuk] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [lmcjhev] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [mbrgcro] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [rkdfsye] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [usceenq] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [giwsnvd] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [rowrxml] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [opjcmto] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [quiclhl] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [lpgvthe] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [lgqgdsx] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [whhupur] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [ywlnxsf] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [pttmqhp] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [wqvvcpw] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [dqwprfk] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [lwrhrue] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [iypuetr] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [mqariog] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [rlyeeqf] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [isnwvmu] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [aubjtoc] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [wmvfgvj] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [srpsjxh] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [suhxlod] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [vwxjexw] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [bhlohhj] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [hlsjktl] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [guqckdi] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [wtcwhkl] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [wrxqpcv] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [cikadkc] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [gksmnmf] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [viqdhko] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [mqtihfb] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [mghrwjx] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [ltytiqi] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [ytrilxw] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [vdjnblk] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [nefwudk] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [elgixew] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [faohbiq] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [ysgpgub] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [ruikkry] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [bblkgtt] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [yphjktu] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [sislahb] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [cfxxsmr] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [cswnraf] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [cicrsgn] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [rwgntse] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [bmoxfvp] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [odtifyd] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [uutjeau] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [hduiqex] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [jnpwqvd] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [ywnccyq] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [sjeqohs] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [oblkawh] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [esrpawp] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [xkjqdhk] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [ponfrcx] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [fwrnsub] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [smdkonq] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [eoruluf] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [mydesvb] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [mmwxvkf] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [nekctxo] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [lhljipf] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [numktah] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [djtorem] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [conjbtx] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [kjsihxm] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [xqxtfxq] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [hatdsnu] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [arnxxwv] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [tcafbmn] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [xdbbcgk] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [mvolojl] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [ymuqwum] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [vvtbhmm] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [sobmwwt] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [punjutx] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [jktuhso] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [ybuuudw] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [iugsiob] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [rbbjcta] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [peygjvo] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [amsigiu] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [qrlcood] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [ypaivvm] c:\windows\cksqdxn.exe
O4 - HKCU\..\Run: [lsutgkr] c:\windows\odqyynk.exe
O4 - HKCU\..\Run: [jdvakih] c:\windows\odqyynk.exe
O4 - HKCU\..\Run: [rdyeuhb] c:\windows\odqyynk.exe
O4 - HKCU\..\Run: [clroapg] c:\windows\odqyynk.exe
O4 - HKCU\..\Run: [iaflhnj] c:\windows\odqyynk.exe
O4 - HKCU\..\Run: [mtyoagn] c:\windows\odqyynk.exe
O4 - HKCU\..\Run: [myudgit] c:\windows\odqyynk.exe
O4 - HKCU\..\Run: [sfjwdqt] c:\windows\odqyynk.exe
O4 - HKCU\..\Run: [instheb] c:\windows\odqyynk.exe
O4 - HKCU\..\Run: [hngxrfi] c:\windows\odqyynk.exe
O4 - HKCU\..\Run: [eonqisg] c:\windows\odqyynk.exe
O4 - HKCU\..\Run: [fhqitxy] c:\windows\odqyynk.exe
O4 - HKCU\..\Run: [focwpeq] c:\windows\odqyynk.exe
O4 - HKCU\..\Run: [momedcd] c:\windows\odqyynk.exe
O4 - HKCU\..\Run: [keibmds] c:\windows\odqyynk.exe
O4 - HKCU\..\Run: [aculdgd] c:\windows\odqyynk.exe
O4 - HKCU\..\Run: [usmjilf] c:\windows\odqyynk.exe
O4 - HKCU\..\Run: [sdawaux] c:\windows\odqyynk.exe
O4 - HKCU\..\Run: [bxhqmfj] c:\windows\odqyynk.exe
O4 - HKCU\..\Run: [cylrmeg] c:\windows\odqyynk.exe
O4 - HKCU\..\Run: [gffmhhr] c:\windows\odqyynk.exe
O4 - HKCU\..\Run: [ggcyutp] c:\windows\jhupgyc.exe
O4 - HKCU\..\Run: [aprhjfd] c:\windows\jhupgyc.exe
O4 - HKCU\..\Run: [hcyrtmv] c:\windows\jhupgyc.exe
O4 - HKCU\..\Run: [ajdkgwv] c:\windows\jhupgyc.exe
O4 - HKCU\..\Run: [dpmhktk] c:\windows\jhupgyc.exe
O4 - HKCU\..\Run: [yngxnqo] c:\windows\jhupgyc.exe
O4 - HKCU\..\Run: [wgctcfl] c:\windows\jhupgyc.exe
O4 - HKCU\..\Run: [yijkdqt] c:\windows\jhupgyc.exe
O4 - HKCU\..\Run: [mmftyds] c:\windows\jhupgyc.exe
O4 - HKCU\..\Run: [okkatid] c:\windows\jhupgyc.exe
O4 - HKCU\..\Run: [nbokaje] c:\windows\jhupgyc.exe
O4 - HKCU\..\Run: [bjsuwfs] c:\windows\jhupgyc.exe
O4 - HKCU\..\Run: [fbomnsf] c:\windows\jhupgyc.exe
O4 - HKCU\..\Run: [esqfbld] c:\windows\jhupgyc.exe
O4 - HKCU\..\Run: [jyutbfm] c:\windows\jhupgyc.exe
O4 - HKCU\..\Run: [kjmwhpu] c:\windows\jhupgyc.exe
O4 - HKCU\..\Run: [seordee] c:\windows\jhupgyc.exe
O4 - HKCU\..\Run: [yxbvnql] c:\windows\jhupgyc.exe
O4 - HKCU\..\Run: [tmpmmiv] c:\windows\jhupgyc.exe
O4 - HKCU\..\Run: [bdtuwak] c:\windows\jhupgyc.exe
O4 - HKCU\..\Run: [gtopqjb] c:\windows\jhupgyc.exe
O4 - HKCU\..\Run: [ykocosd] c:\windows\jhupgyc.exe
O4 - HKCU\..\Run: [eqvdmra] c:\windows\jhupgyc.exe
O4 - HKCU\..\Run: [qewpyys] c:\windows\jhupgyc.exe
O4 - HKCU\..\Run: [lvlyvnr] c:\windows\jhupgyc.exe
O4 - HKCU\..\Run: [uxrevnp] c:\windows\jhupgyc.exe
O4 - HKCU\..\Run: [csrcdhl] c:\windows\jhupgyc.exe
O4 - HKCU\..\Run: [ogskmhe] c:\windows\jhupgyc.exe
O4 - HKCU\..\Run: [raiafmb] c:\windows\jhupgyc.exe
O4 - HKCU\..\Run: [tmqnbjk] c:\windows\jhupgyc.exe
O4 - HKCU\..\Run: [aagxcpu] c:\windows\jhupgyc.exe
O4 - HKCU\..\Run: [tfhtxvv] c:\windows\jhupgyc.exe
O4 - HKCU\..\Run: [qcurwpm] c:\windows\jhupgyc.exe
O4 - HKCU\..\Run: [tvyyywj] c:\windows\jhupgyc.exe
O4 - HKCU\..\Run: [kltprnl] c:\windows\jhupgyc.exe
O4 - HKCU\..\Run: [tnaqhaa] c:\windows\jhupgyc.exe
O4 - HKCU\..\Run: [lbnyrmb] c:\windows\jhupgyc.exe
O4 - HKCU\..\Run: [dlyyjre] c:\windows\jhupgyc.exe
O4 - HKCU\..\Run: [pginays] c:\windows\jhupgyc.exe
O4 - HKCU\..\Run: [oeiscmk] c:\windows\jhupgyc.exe
O4 - HKCU\..\Run: [ojntamh] c:\windows\jhupgyc.exe
O4 - HKCU\..\Run: [svatabs] c:\windows\jhupgyc.exe
O4 - HKCU\..\Run: [qtavmml] c:\windows\jhupgyc.exe
O4 - HKCU\..\Run: [nbbphyt] c:\windows\jhupgyc.exe
O4 - HKCU\..\Run: [tcqmtph] c:\windows\jhupgyc.exe
O4 - HKCU\..\Run: [soeojnt] c:\windows\jhupgyc.exe
O4 - HKCU\..\Run: [lappdcm] c:\windows\jhupgyc.exe
O4 - HKCU\..\Run: [cjvnqip] c:\windows\krunpwm.exe
O4 - HKCU\..\Run: [dcqrfnn] c:\windows\krunpwm.exe
O4 - HKCU\..\Run: [fchhcqx] c:\windows\krunpwm.exe
O4 - HKCU\..\Run: [ilhktsu] c:\windows\krunpwm.exe
O4 - HKCU\..\Run: [mdcrxkw] c:\windows\krunpwm.exe
O4 - HKCU\..\Run: [lpqhvjt] c:\windows\krunpwm.exe
O4 - HKCU\..\Run: [gujwqmi] c:\windows\krunpwm.exe
O4 - HKCU\..\Run: [cuaxsrl] c:\windows\krunpwm.exe
O4 - HKCU\..\Run: [rtqcwop] c:\windows\krunpwm.exe
O4 - HKCU\..\Run: [vnpjkhy] c:\windows\krunpwm.exe
O4 - HKCU\..\Run: [awtmcee] c:\windows\krunpwm.exe
O4 - HKCU\..\Run: [qohtvuw] c:\windows\krunpwm.exe
O4 - HKCU\..\Run: [wicexmv] c:\windows\krunpwm.exe
O4 - HKCU\..\Run: [cailcdj] c:\windows\krunpwm.exe
O4 - HKCU\..\Run: [rvfqcqs] c:\windows\krunpwm.exe
O4 - HKCU\..\Run: [qcfenrw] c:\windows\krunpwm.exe
O4 - HKCU\..\Run: [ajomxgs] c:\windows\krunpwm.exe
O4 - HKCU\..\Run: [kihumsj] c:\windows\atfavoq.exe
O4 - HKCU\..\Run: [jbktjlo] c:\windows\atfavoq.exe
O4 - HKCU\..\Run: [lecutwj] c:\windows\atfavoq.exe
O4 - HKCU\..\Run: [ihstafv] c:\windows\atfavoq.exe
O4 - HKCU\..\Run: [svfmjwa] c:\windows\atfavoq.exe
O4 - HKCU\..\Run: [rwsgbfa] c:\windows\atfavoq.exe
O4 - HKCU\..\Run: [tancrce] c:\windows\atfavoq.exe
O4 - HKCU\..\Run: [orwpnbi] c:\windows\atfavoq.exe
O4 - HKCU\..\Run: [jxmrseo] c:\windows\ogiqoxt.exe
O4 - HKCU\..\Run: [opcodmw] c:\windows\ogiqoxt.exe
O4 - HKCU\..\Run: [lusanoh] c:\windows\ogiqoxt.exe
O4 - HKCU\..\Run: [uwajrem] c:\windows\ogiqoxt.exe
O4 - HKCU\..\Run: [rdlolfl] c:\windows\ogiqoxt.exe
O4 - HKCU\..\Run: [sccmrsi] c:\windows\xdeprns.exe
O4 - HKCU\..\Run: [lfosrdm] c:\windows\xdeprns.exe
O4 - HKCU\..\Run: [ltussjg] c:\windows\xdeprns.exe
O4 - HKCU\..\Run: [nnslsic] c:\windows\xdeprns.exe
O4 - HKCU\..\Run: [mtwdpwd] c:\windows\xdeprns.exe
O4 - HKCU\..\Run: [sliykyy] c:\windows\xdeprns.exe
O4 - HKCU\..\Run: [xddmdrx] c:\windows\xdeprns.exe
O4 - HKCU\..\Run: [wiigsxm] c:\windows\xdeprns.exe
O4 - HKCU\..\Run: [twphdnt] c:\windows\xdeprns.exe
O4 - HKCU\..\Run: [nfnroet] c:\windows\xdeprns.exe
O4 - HKCU\..\Run: [vmjlmwp] c:\windows\xdeprns.exe
O4 - HKCU\..\Run: [uifsiof] c:\windows\xdeprns.exe
O4 - HKCU\..\Run: [acasnru] c:\windows\xdeprns.exe
O4 - HKCU\..\Run: [jigvnkl] c:\windows\xdeprns.exe
O4 - HKCU\..\Run: [uabptan] c:\windows\xdeprns.exe
O4 - HKCU\..\Run: [exlmjhn] c:\windows\xdeprns.exe
O4 - HKCU\..\Run: [ediqvwv] c:\windows\xdeprns.exe
O4 - HKCU\..\Run: [ueavkrr] c:\windows\xdeprns.exe
O4 - HKCU\..\Run: [otarwdp] c:\windows\xdeprns.exe
O4 - HKCU\..\Run: [akwebet] c:\windows\xdeprns.exe
O4 - HKCU\..\Run: [qwibahh] c:\windows\xdeprns.exe
O4 - HKCU\..\Run: [qnnryby] c:\windows\xdeprns.exe
O4 - HKCU\..\Run: [ydlgokq] c:\windows\xdeprns.exe
O4 - HKCU\..\Run: [tayxanu] c:\windows\xdeprns.exe
O4 - HKCU\..\Run: [wftcala] c:\windows\xdeprns.exe
O4 - HKCU\..\Run: [fniterj] c:\windows\xdeprns.exe
O4 - HKCU\..\Run: [hfkkvyl] c:\windows\xdeprns.exe
O4 - HKCU\..\Run: [lvhwksy] c:\windows\xdeprns.exe
O4 - HKCU\..\Run: [cwdpeny] c:\windows\xdeprns.exe
O4 - HKCU\..\Run: [nrlacxb] c:\windows\xdeprns.exe
O4 - HKCU\..\Run: [kemedtf] c:\windows\xdeprns.exe
O4 - HKCU\..\Run: [uthkhdn] c:\windows\xdeprns.exe
O4 - HKCU\..\Run: [tpingwc] c:\windows\xdeprns.exe
O4 - HKCU\..\Run: [krdkexe] c:\windows\xdeprns.exe
O4 - HKCU\..\Run: [xynsjri] c:\windows\xdeprns.exe
O4 - HKCU\..\Run: [ogxtqcp] c:\windows\xdeprns.exe
O4 - HKCU\..\Run: [twihrgs] c:\windows\xdeprns.exe
O4 - HKCU\..\Run: [sjpmmvk] c:\windows\xdeprns.exe
O4 - HKCU\..\Run: [mkjdghd] c:\windows\xdeprns.exe
O4 - HKCU\..\Run: [nonkqsq] c:\windows\xdeprns.exe
O4 - HKCU\..\Run: [lxxksql] c:\windows\xdeprns.exe
O4 - HKCU\..\Run: [ovpuxrr] c:\windows\xdeprns.exe
O4 - HKCU\..\Run: [vxmpmwj] c:\windows\xdeprns.exe
O4 - HKCU\..\Run: [hbtsnng] c:\windows\qxtfrel.exe
O4 - HKCU\..\Run: [wbrodlp] c:\windows\qxtfrel.exe
O4 - HKCU\..\Run: [dvmibtg] c:\windows\qxtfrel.exe
O4 - HKCU\..\Run: [amyisdb] c:\windows\hdcssqb.exe
O4 - HKCU\..\Run: [ffybchr] c:\windows\ofgaibb.exe
O4 - HKCU\..\Run: [dpjvkst] c:\windows\ofgaibb.exe
O4 - HKCU\..\Run: [qktftjq] c:\windows\ofgaibb.exe
O4 - HKCU\..\Run: [biwlumq] c:\windows\ofgaibb.exe
O4 - HKCU\..\Run: [hfxinvn] c:\windows\ofgaibb.exe
O4 - HKCU\..\Run: [kqsefav] c:\windows\ofgaibb.exe
O4 - HKCU\..\Run: [mghghhr] c:\windows\ofgaibb.exe
O4 - HKCU\..\Run: [yyswvty] c:\windows\ofgaibb.exe
O4 - HKCU\..\Run: [usicbnj] c:\windows\ofgaibb.exe
O4 - HKCU\..\Run: [itruyau] c:\windows\ofgaibb.exe
O4 - HKCU\..\Run: [hnmxfvu] c:\windows\ofgaibb.exe
O4 - HKCU\..\Run: [tcsgxte] c:\windows\ofgaibb.exe
O4 - HKCU\..\Run: [cowyhuc] c:\windows\ofgaibb.exe
O4 - HKCU\..\Run: [fmgidbg] c:\windows\ofgaibb.exe
O4 - HKCU\..\Run: [jbkkenv] c:\windows\ofgaibb.exe
O4 - HKCU\..\Run: [prdqwqf] c:\windows\ofgaibb.exe
O4 - HKCU\..\Run: [pteoisv] c:\windows\ofgaibb.exe
O4 - HKCU\..\Run: [ltfhrrd] c:\windows\ofgaibb.exe
O4 - HKCU\..\Run: [asybnai] c:\windows\ofgaibb.exe
O4 - HKCU\..\Run: [sueqvqh] c:\windows\ofgaibb.exe
O4 - HKCU\..\Run: [kmnwyaa] c:\windows\ofgaibb.exe
O4 - HKCU\..\Run: [jdsnhtp] c:\windows\ofgaibb.exe
O4 - HKCU\..\Run: [ltnukag] c:\windows\ofgaibb.exe
O4 - HKCU\..\Run: [njyyyjq] c:\windows\ofgaibb.exe
O4 - HKCU\..\Run: [byopyyr] c:\windows\ofgaibb.exe
O4 - HKCU\..\Run: [qngqiiq] c:\windows\ofgaibb.exe
O4 - HKCU\..\Run: [eesnyju] c:\windows\ofgaibb.exe
O4 - HKCU\..\Run: [rgdtamd] c:\windows\ofgaibb.exe
O4 - HKCU\..\Run: [xmcrfjk] c:\windows\ofgaibb.exe
O4 - HKCU\..\Run: [mfamgks] c:\windows\ofgaibb.exe
O4 - HKCU\..\Run: [adbootu] c:\windows\ofgaibb.exe
O4 - HKCU\..\Run: [pflcftb] c:\windows\ofgaibb.exe
O4 - HKCU\..\Run: [kelsujw] c:\windows\ofgaibb.exe
O4 - HKCU\..\Run: [qusmtfm] c:\windows\ofgaibb.exe
O4 - HKCU\..\Run: [lpmfwwu] c:\windows\ofgaibb.exe
O4 - HKCU\..\Run: [jqolrxp] c:\windows\ofgaibb.exe
O4 - HKCU\..\Run: [cdmkins] c:\windows\ofgaibb.exe
O4 - HKCU\..\Run: [tejfxtn] c:\windows\ofgaibb.exe
O4 - HKCU\..\Run: [rmlwfei] c:\windows\ofgaibb.exe
O4 - HKCU\..\Run: [yvramsw] c:\windows\ofgaibb.exe
O4 - HKCU\..\Run: [vggacty] c:\windows\ofgaibb.exe
O4 - HKCU\..\Run: [qiwrjey] c:\windows\ofgaibb.exe
O4 - HKCU\..\Run: [vkdypww] c:\windows\ofgaibb.exe
O4 - HKCU\..\Run: [pqhixsh] c:\windows\ofgaibb.exe
O4 - HKCU\..\Run: [eflreex] c:\windows\ofgaibb.exe
O4 - HKCU\..\Run: [ckqynif] c:\windows\ofgaibb.exe
O4 - HKCU\..\Run: [iunwaym] c:\windows\ofgaibb.exe
O4 - HKCU\..\Run: [sktmoii] c:\windows\ofgaibb.exe
O4 - HKCU\..\Run: [gihcrav] c:\windows\ofgaibb.exe
O4 - HKCU\..\Run: [mqmlsup] c:\windows\ofgaibb.exe
O4 - HKCU\..\Run: [rqtupbm] c:\windows\ofgaibb.exe
O4 - HKCU\..\Run: [jdduprj] c:\windows\ofgaibb.exe
O4 - HKCU\..\Run: [gpgqctl] c:\windows\ofgaibb.exe
O4 - HKCU\..\Run: [tfciode] c:\windows\ofgaibb.exe
O4 - HKCU\..\Run: [frfutjb] c:\windows\ofgaibb.exe
O4 - HKCU\..\Run: [dgscasg] c:\windows\ofgaibb.exe
O4 - HKCU\..\Run: [joncduv] c:\windows\ofgaibb.exe
O4 - HKCU\..\Run: [pgtcvhe] c:\windows\ofgaibb.exe
O4 - HKCU\..\Run: [rbtomob] c:\windows\ofgaibb.exe
O4 - HKCU\..\Run: [oovdnxx] c:\windows\ofgaibb.exe
O4 - HKCU\..\Run: [gixwerc] c:\windows\ofgaibb.exe
O4 - HKCU\..\Run: [trhayyy] c:\windows\ofgaibb.exe
O4 - HKCU\..\Run: [xkssiwq] c:\windows\ofgaibb.exe
O4 - HKCU\..\Run: [jfnceif] c:\windows\ofgaibb.exe
O4 - HKCU\..\Run: [wknpktw] c:\windows\ofgaibb.exe
O4 - HKCU\..\Run: [bljkyjo] c:\windows\ofgaibb.exe
O4 - HKCU\..\Run: [twnhuwa] c:\windows\ofgaibb.exe
O4 - HKCU\..\Run: [jqddenn] c:\windows\ofgaibb.exe
O4 - HKCU\..\Run: [eljluha] c:\windows\ubuqlru.exe
O4 - HKCU\..\Run: [hadnedm] c:\windows\ubuqlru.exe
O4 - HKCU\..\Run: [lkmddye] c:\windows\ubuqlru.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O10 - Unknown file in Winsock LSP: c:\windows\system32\flsmngr.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\flsmngr.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\flsmngr.dll
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EP…l_v1-0-3-24.cab
O16 - DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} (PhotoPickConvert Class) - http://appdirectory.messenger.msn.com/AppD…ap/PhtPkMSN.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmesse…pdownloader.cab
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\Diskeeper\DkService.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

Its a beauty isnt it??

abcnightmare

Post #3June 16, 2005, 4:31 PM UTC

Ok I got bored waiting for someone to help and I had a little dabble.
and it goes like this now,, I deleted 523 entries :- seems ok but I need real help from someone . Thanks.

Logfile of HijackThis v1.99.1
Scan saved at 17:26:22, on 16/06/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\EPoX\USDM\USDM.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\System32\CTHELPER.EXE
C:\Program Files\Creative\SBAudigy\AudioHQ\AHQTBU.EXE
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
C:\PROGRA~1\PESTPA~1\PPControl.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb10.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Google\Gmail Notifier\gnotify.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Executive Software\Diskeeper\DkService.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Ade\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: Norton Internet Security - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [EPoXUSDM] "C:\Program Files\EPoX\USDM\USDM.EXE" "5000"
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [CTStartup] C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE /run
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [AudioHQU] C:\Program Files\Creative\SBAudigy\AudioHQ\AHQTBU.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Executive Software\Diskeeper\DkIcon.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [PestPatrol Control Center] C:\PROGRA~1\PESTPA~1\PPControl.exe
O4 - HKLM\..\Run: [RemoteControl] C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
O4 - HKLM\..\Run: [PPMemCheck] C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
O4 - HKLM\..\Run: [CookiePatrol] C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb10.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [ImInstaller_IncrediMail] C:\DOCUME~1\Alex\LOCALS~1\Temp\ImInstaller\IncrediMail\imloader.exe -startup -product IncrediMail
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O10 - Unknown file in Winsock LSP: c:\windows\system32\flsmngr.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\flsmngr.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\flsmngr.dll
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EP…l_v1-0-3-24.cab
O16 - DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} (PhotoPickConvert Class) - http://appdirectory.messenger.msn.com/AppD…ap/PhtPkMSN.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmesse…pdownloader.cab
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\Diskeeper\DkService.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

abcnightmare

Post #4June 19, 2005, 7:14 PM UTC

Please help I have had acess to limited web use and loads of adult freind finders and p orn site which I could well do without as I have children who use the computer as well. who manufactures these hijackers trojans?? cant they be fined for wasting everyones time? until then please help. Thanks

Siggyx

Post #5June 19, 2005, 8:03 PM UTC

Download hijackthis to its own folder C:/HJT for example. Extrat the zip file to that folder. Then close all browseer windows, open hijackthis and click on scan. Once the scan has completed click on Save Log, this will produce a text file log. Highlight all of the information from in that text box then right click and copy. Come back to this post you made and click on "add reply" at the bottom right and a new window will open. Paste the hijackthis log into the new window hit add reply in that new window.

HJT download >>> http://www.softpedia.com/public/cat/10/17/10-17-69.shtml

abcnightmare

Post #6June 19, 2005, 10:16 PM UTC

Cant download off that site as I have a alert message saying security does not allow it, heres a recent copy anyway

Logfile of HijackThis v1.99.1
Scan saved at 23:11:10, on 19/06/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Executive Software\Diskeeper\DkService.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\System32\CTHELPER.EXE
C:\Program Files\Creative\SBAudigy\AudioHQ\AHQTBU.EXE
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
C:\PROGRA~1\PESTPA~1\PPControl.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb10.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Google\Gmail Notifier\gnotify.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\eDonkey2000\edonkey2000.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\System32\CTHELPER.EXE
C:\Program Files\Creative\SBAudigy\AudioHQ\AHQTBU.EXE
C:\WINDOWS\System32\RUNDLL32.EXE
C:\PROGRA~1\PESTPA~1\PPControl.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb10.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Google\Gmail Notifier\gnotify.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Ade\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: Norton Internet Security - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [CTStartup] C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE /run
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [AudioHQU] C:\Program Files\Creative\SBAudigy\AudioHQ\AHQTBU.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Executive Software\Diskeeper\DkIcon.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [PestPatrol Control Center] C:\PROGRA~1\PESTPA~1\PPControl.exe
O4 - HKLM\..\Run: [RemoteControl] C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
O4 - HKLM\..\Run: [PPMemCheck] C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
O4 - HKLM\..\Run: [CookiePatrol] C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb10.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O10 - Unknown file in Winsock LSP: c:\windows\system32\flsmngr.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\flsmngr.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\flsmngr.dll
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EP…l_v1-0-3-24.cab
O16 - DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} (PhotoPickConvert Class) - http://appdirectory.messenger.msn.com/AppD…ap/PhtPkMSN.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmesse…pdownloader.cab
O18 - Filter: text/html - (no CLSID) - (no file)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\Diskeeper\DkService.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

Siggyx

Post #7June 20, 2005, 1:08 AM UTC

First click here>>> http://cexx.org/lspfix.htm to download LSPFix. Extract the program from the zip file and run it, make sure you click the "I know what I'm doing" button. Select flsmngr.dll and using the right-pointing 'arrows' and move all instances of flsmngr.dll
it mentions to the Remove (RHS) side but leave everything else (it might already be over there when you open LSPFix). Click the 'Finished' button (if you exit with the X at top right nothing happens).

REBOOT to complete the task.

Then scan with hijackthis and post a new log please.

abcnightmare

Post #8June 20, 2005, 5:59 PM UTC

My browser has been hijacked and I cannot download …….anything……. nothing.. so can you email me the file ? I tried to load this from a clean computer via a floppy disk but the bug prevents me from viewing the file let alone loading it. I will try the disk in safe mode any way speak soon

Siggyx

Post #9June 20, 2005, 6:09 PM UTC

try downloading here

Siggyx

Post #10June 20, 2005, 6:19 PM UTC

try downloading here

Attachments:

📎lspfix.zip

abcnightmare

Post #11June 20, 2005, 8:27 PM UTC

Safe mode didnt work either still can not download this….this is the message.. Security Alert your current security settings do not allow this file to be downloaded perhaps if the name is changed??

Siggyx

Post #12June 22, 2005, 1:53 AM UTC

Can you change your security settings?

abcnightmare

Post #13June 22, 2005, 9:03 AM UTC

Hi, This is a saga now, the machine has stopped the internet access so Icant do anything, except borrow some one elses. I have disabled norton ect tried to download the file from you treid to read from a floppy disk.all with the same result…… security alert…….blah blah. at a loss as what to do as I can see the files that need deleting but cannot access them.??

Siggyx

Post #14June 23, 2005, 4:08 AM UTC

You can download it to a disk, the program is not large. Then install it on the system.

abcnightmare

Post #15June 24, 2005, 7:56 AM UTC

I have tried with a floppy disk as well , I still get the same securitry warning. Security Alert your current security settings do not allow this file to be downloaded.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

15/ 6 / 05 and no reply HELP please

✨ Ask AI

Ask AI