Spyware / Malware / Virus Removal

Another malware victim

42 min read

Looking for the outcome? Ask AI

Elrond

Post #16July 24, 2005, 7:52 PM UTC

Hi jacqueee.

Again we got rid of some junk but this is a slow process. It seems that you have at least one infection that is a new variant of its kind and some people are trying to find a good way to get rid of it.

If there is anything you have problems with in the instructions please ask me and I will do my best to answer and explain.

The first thing we need to do is to make it possible to see all files. Even those that are super hidden.
- Click Start > My Computer > Tools menu (at top of page) > Folder Options > View tab.
  Under "Hidden files and folders" select Show hidden files and folders.
  Uncheck Hide protected operating system files (recommended).
  Uncheck Hide file extensions for known file types.
  Click OK
- Please download xphidden.zip to your desktop.
  *Double click on the XPHidden.zip to open the file
  *then double click on xphidden.reg to add the information to your registry.
  *This will cause all super-hidden files and protected system files to be visible.
  BE CAREFUL WITH DELETING FILES YOU DO NOT RECOGNIZE until we have hidden system and super hidden files again.
You have a number of files that the people who analyze the malware and develop the tools and antispyware programs would like to get a look at.
To submit them to organizations and individuals that do this type of work please do the following:

a. Using Windows Explorer, go to C:\WINDOWS\Temp\. Locate the first file upd205.exe that you want to zip.
b. Right click on the file and select "Send To" and "Compressed (zipped) Folder".
c. Still in C:\WINDOWS\Temp\ locate and right click on upd207.exe. Select "Copy".
d. Right click on the compressed folder and select "Paste". The copied files will be compressed and pasted into the zipped folder.
e. Repeat steps c. and d. for the following files
upd208.exe.exe
f. Note that the folder should have 3files in it if you found them all.
g. Right click on the zipped folder and select "Explore".
h. In "File" menu select "Add a Password". Enter the password infected and confirm the password.
Please email to elrondAThostingatessex.com (Please replace the 'AT' with an '@' )

Please copy text from the following quote box to the text area in the email.

The password is "infected".
The thread is found here. http://forums.tomcoyote.org/index.php?showtopic=40936&st;=0&#

and attach the zipped file(s).
Download but don't run yet: Hoster from http://members.aol.com/toadbee/hoster.zip.
Download but don't run yet: WinsockXPFix from http://www.spychecker.com/program/winsockxpfix.html
To see if there are any more of the L2M files around I want you to:
- Download finditnt2000xp.zip from http://lineofire.geekstogo.com/FindIt%20NT-2K-XP.zip.
- Unzip the contents of finditnt.zip to a convenient location such as Desktop. (Place the zip file in the folder where you want the unzipped program to be. Simply right click the zip file and select extract here.
- Navigate to the Find It NT-2K-XP folder and double-click on find.bat.
- A command prompt will open and it will search your computer for malicious files.
  Once it has finished a Notepad window will pop up with output.txt.
- Copy the entire contents of output.txt into your next post, and include another HijackThis log please.
- Try not to reboot after doing this, until I get back to you.
  
  Thanks.
E

jacqueee

Post #17July 26, 2005, 12:41 AM UTC

Hello!!

I ran a search for the
a. Using Windows Explorer, go to C:\WINDOWS\Temp\. Locate the first file upd205.exe that you want to zip.

c. Still in C:\WINDOWS\Temp\ locate and right click on upd207.exe. Select "Copy".

e. Repeat steps c. and d. for the following files
upd208.exe.exe

These files upd205.exe, upd207.exe, upd208.exe were NOT FOUND on the search.

Download but don't run yet: Hoster from http://members.aol.com/toadbee/hoster.zip.

I still am not able to download the hoster.zip Maybe because I am not an AOL member.

I was able to execute the following:

—————- FindVX2 NT-2K-XP —————-

Warning! This utility will find legitimate files in addition to malware.
Do not remove anything unless you are sure you know what you're doing.

***** Operating System *****

Microsoft Windows XP Home Edition 5.1 Service Pack 1 (Build 2600)

********* Date/Time ********

Monday, July 25, 2005 (07/25/2005)
8:16 PM, Eastern Daylight Time

*********** Path ***********

FindVX2.bat is running from: C:\unzipped\FindIt NT-2K-XP\FindIt NT-2K-XP

——- System Files in System32 Directory ——-

Volume in drive C has no label.
Volume Serial Number is 74F5-825C

Directory of C:\WINDOWS\System32

07/12/2005 09:14 PM DLLCACHE
02/21/2002 11:18 PM Microsoft
09/30/1999 07:21 PM 166,672 mstext35.dll
09/28/1999 09:42 PM 1,050,896 msjet35.dll
09/09/1999 10:06 PM 168,720 msltus35.dll
09/09/1999 10:06 PM 252,688 msexcl35.dll
08/25/1999 02:57 PM 415,504 msrepl35.dll
06/07/1999 06:59 PM 250,128 mspdox35.dll
04/25/1999 05:00 PM 287,504 Msxbse35.dll
7 File(s) 2,592,112 bytes
2 Dir(s) 65,028,665,344 bytes free

——- Hidden Files in System32 Directory ——-

Volume in drive C has no label.
Volume Serial Number is 74F5-825C

Directory of C:\WINDOWS\System32

07/15/2005 02:47 PM vidctrl
07/15/2005 02:47 PM nsvsvc
07/12/2005 09:14 PM DLLCACHE
0 File(s) 0 bytes
3 Dir(s) 65,028,661,248 bytes free

————— Files Named "Guard" ————–

Volume in drive C has no label.
Volume Serial Number is 74F5-825C

Directory of C:\WINDOWS\System32

——– Temp Files in System32 Directory ——–

Volume in drive C has no label.
Volume Serial Number is 74F5-825C

Directory of C:\WINDOWS\System32

05/05/2005 10:41 AM 0 REN387.tmp
05/05/2005 10:41 AM 0 REN386.tmp
09/22/2004 07:46 PM 5,550,080 setb10.tmp
08/18/2001 08:00 AM 2,577 CONFIG.TMP
05/23/2001 01:00 AM 86,016 SET11.tmp
06/08/2000 01:00 PM 995,383 mfc42.dll.tmp
6 File(s) 6,634,056 bytes
0 Dir(s) 65,028,661,248 bytes free

——————- User Agent ——————-

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"SV1"=""

————— Keys Under Notify —————-

REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,72,79,70,74,33,32,2e,64,6c,6c,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,72,79,70,74,6e,65,74,2e,64,6c,6c,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,6c,6e,6f,74,69,66,79,2e,64,6c,6c,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,63,6c,67,6e,74,66,79,2e,64,6c,6c,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,6c,6e,6f,74,69,66,79,2e,64,6c,6c,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif]
"DLLName"="wzcdlg.dll"
"Logon"="WZCEventLogon"
"Logoff"="WZCEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000000

———— Shell Extensions Approved ———–

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]

————— Locate.com Results —————

No matches found.

—————- FindVX2 NT-2K-XP —————-

I can download http://www.spychecker.com/program/winsockxpfix.html when you are ready. I wasn't sure if you wanted it now because I wasn't able to find the upd205, 207 and 208 files and was still not able to download the AOL
http://members.aol.com/toadbee/hoster.zip.

I am so sorry to take so much of your time! I appreciate everything and hope this will result in someone being able to KILL all the malware!!!

Elrond

Post #18July 26, 2005, 1:45 AM UTC

No problem. I will be back with you tommorw with new instructions. It was good that youwas unable to find the files that I was looking for. It looks as if we got rid of the L2M infection according to what I can see. Will check further how ever. Do not feel bad when things do not go according to plan. It happens. If that was not the case it would be easy to get rid of the Slyware. You are doing great.

Elrond

Post #19July 27, 2005, 3:35 AM UTC last edited July 27, 2005, 3:38 AM UTC

Good jaqueee, we got rid of one miserable infection.

Let's see if we will have as much success with the other ones.

See if you can download Hoster from this Website: http://www.funkytoad.com/download/hoster.zip. I believe that I gave you the wrong wed address before.
- Extract it from its zip file in the same manner as you did above.
- Find Hoster.exe in the "Hoster" folder. It could be that you need to open more than one layer of foldersto find it.
- Open Hoster.exe.
- Click the Backup Hosts File
- Then click the Restore Original Hosts button.
- When complete close the program.
Now I would like you to run Ewido again.

Please print out the following instructions as this page will be unavailable to you while you are working in Safe Mode, and you should have all windows and folders closed as well.

Please
- Launch ewido, there should be a big "E" icon on your desktop, double-click it.
- The program will prompt you to update; click the "OK" button
- The program will now go to the main screen
  
  Update ewido:
  
  You will need to update ewido to the latest definition files.
- On the left hand side of the main screen click update
- Click on Start
  
  The update will start and a progress bar will show the updates being installed. After the updates are installed, exit ewido.
  
  IMPORTANT!:
  
  Once the updates are installed do the following:
- If you have an "always on" connection to the internet, physically disconnect that connection until you are finished with Safe Mode and have rebooted back into normal mode.
- This is important. Reboot into Safe Mode, Restart the computer. When the BIOS has finished loading (before Windows starts loading) start rapidly tapping the "F8". On the list of Startup alternatives select "Safe Mode". Windows will start up with the information that you are running in Safe Mode. Screen can look different from what you are used to.
  This can be tricky. If Windows starts up in normal mode, repeat the process. If you have a keyboard with a "F Lock" key click it so that the "F" light above it is on when you start tapping the "F8" key.
- Close all open windows/programs/folders. Have nothing else open while ewido performs its scan!
  
  Scan with ewido:
- Click on scanner
- Click on Settings
  - Under "How to scan" all boxes should be selected
  - Under "Possibly unwanted software" all boxes should be selected
  - Under "What to scan" select scan every file
  - Click OK
- Click on Complete system scan
- Let the program scan the machine
- If ewido finds anything, it will pop up a notification. NOTE: We have been finding some cases of false positives with the new version of Ewido, so you need to step through the fixes one-by-one. If Ewido finds something that you KNOW is legitimate (for example, parts of AVG Antivirus, AOL, pcAnywhere and the game "Risk" have been flagged. In particular, watch for alerts that have the word "Heuristic" in them - if you recognize the file name as "friendly," these may actually be false positives) select "none" as the action. DO NOT check "Perform action with all infections." If you are unsure of an entry, select "none" for the time being. I will see it in the log that you will post later and will let you know if ewido needs to be run again.
  
  Save and Post Your Report:
  
  Once the scan has completed, there will be a button located on the bottom of the screen named Save report.
- Click Save report
- Save the report to your desktop
- Exit ewido
reboot back into normal mode

When you are ready to post your next reply to your active topic, double click on the saved report to open it, then use Ctrl + A to select all text, then Ctrl + C to copy the selected text to your clipboard. Next, open a new reply to your active topic, and use Ctrl + V to paste the copied text of the ewido log from your clipboard into your reply.
Run a new HijackThis ascan and post the log together with the Ewido log.

You are doing very well. This is not simple at all. I have been scratching my hair at some points.

jacqueee

Post #20July 28, 2005, 4:59 AM UTC

Thanks!! Here we go!! I really want to thank you for being so patient with me! I know your time is very valuable. You are fantastic!!

———————————————————
ewido security suite - Scan report
———————————————————

+ Created on: 11:10:07 PM, 07/27/2005
+ Report-Checksum: 8785F106

+ Scan result:

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\nukd.exe -> TrojanDownloader.Qoologic.n : Cleaned with backup
C:\Documents and Settings\\Cookies\ s@abetterinternet[1].txt -> Spyware.Cookie.Abetterinternet : Cleaned with backup
C:\Documents and Settings\\Cookies\@revenue[2].txt -> Spyware.Cookie.Revenue : Cleaned with backup
C:\Documents and Settings\J\Cookies\j @ad.yieldmanager[2].txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
C:\Documents and Settings\\Cookies\@burstnet[2].txt -> Spyware.Cookie.Burstnet : Cleaned with backup
C:\Documents and Settings\\Cookies\@e-2dj6wfk4anczskq.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\\Cookies\@e-2dj6wflishcpwdo.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\J\Cookies\[removed][1].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\\Cookies\@e-2dj6wfmikld5ghp.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\J\Cookies\@e-2dj6wfmyqidzckq.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\\Cookies\@e-2dj6wjk4smc5ocp.stats.esomniture[1].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\\Cookies\@e-2dj6wjkockdpibp.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\\Cookies\@e-2dj6wjkogjcpobp.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\\Cookies\@e-2dj6wjkogodjwcp.stats.esomniture[1].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\\Cookies\ @e-2dj6wjkoupd5gho.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\\Cookies\@e-2dj6wjkyokdjaeq.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\\Cookies\@e-2dj6wjkysgczmgq.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\\Cookies\@e-2dj6wjkyshdpodo.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\\Cookies\@e-2dj6wjl4ekc5afo.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\\Cookies\@e-2dj6wjl4enczscp.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\\Cookies\@e-2dj6wjl4kmazeap.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\\Cookies\@e-2dj6wjliakdjilp.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\\Cookies\@e-2dj6wjlisndpsbq.stats.esomniture[1].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\\Cookies\@e-2dj6wjlocgd5alo.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\\Cookies\@e-2dj6wjlyeldpacp.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\\Cookies\[removed][1].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\\Cookies\@e-2dj6wjmicmajolo.stats.esomniture[1].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\\Cookies\@e-2dj6wjmiuicpcdp.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\\Cookies\@e-2dj6wjmyggazmko.stats.esomniture[1].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\\Cookies\@e-2dj6wjny-1id5wg.stats.esomniture[1].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Cookies\@hypertracker[2].txt -> Spyware.Cookie.Hypertracker : Cleaned with backup
C:\Documents and Settings\\Cookies\@pro-market[1].txt -> Spyware.Cookie.Pro-market : Cleaned with backup
C:\Documents and Settings\\Cookies\j @server.iad.liveperson[1].txt -> Spyware.Cookie.Liveperson : Cleaned with backup
C:\Documents and Settings\ \Desktop\l2mfix\backup.zip/hrlo0533e.dll -> Spyware.Look2Me : Error during cleaning
C:\Documents and Settings\Desktop\l2mfix\backup.zip/guard.tmp -> Spyware.Look2Me : Error during cleaning
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP647\A0150444.exe -> Spyware.Pacer : Cleaned with backup
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP652\A0152675.cfg -> Spyware.FlashEnhancer : Cleaned with backup
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP665\A0157131.DLL -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP665\A0157132.DLL -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP665\A0157136.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP665\A0157145.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP665\A0157220.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP665\A0157224.DLL -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP665\A0157236.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP665\A0157240.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP665\A0157295.DLL -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP665\A0157296.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP665\A0157310.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP665\A0157314.DLL -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP665\A0157327.DLL -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP665\A0157328.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP665\A0157402.DLL -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP665\A0157403.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP665\A0157423.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP665\A0157438.DLL -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP665\A0157439.DLL -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP665\A0157448.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP666\A0157517.DLL -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP666\A0157518.DLL -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP666\A0157569.DLL -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP666\A0157570.DLL -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP666\A0157584.dll -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP666\A0157688.DLL -> Spyware.Look2Me : Cleaned with backup
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP666\A0157689.DLL -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\SYSTEM32\bxnccon.exe -> TrojanDownloader.Qoologic.n : Cleaned with backup
C:\WINDOWS\SYSTEM32\conres.cpl -> TrojanDownloader.Qoologic.p : Cleaned with backup
C:\WINDOWS\SYSTEM32\dagfflg.dll -> TrojanDownloader.Qoologic.n : Cleaned with backup
C:\WINDOWS\SYSTEM32\datadx.dll -> TrojanDownloader.Qoologic.p : Cleaned with backup
C:\WINDOWS\SYSTEM32\jqraao.exe -> TrojanDownloader.Qoologic.n : Cleaned with backup
C:\WINDOWS\SYSTEM32\jrndd.dll -> TrojanDownloader.Qoologic.n : Cleaned with backup
C:\WINDOWS\SYSTEM32\pgaqq.dat -> TrojanDownloader.Qoologic.n : Cleaned with backup

::Report End

Logfile of HijackThis v1.99.1
Scan saved at 12:51:02 AM, on 07/28/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Personal Firewall\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINDOWS\DELLMMKB.EXE
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\WINDOWS\System32\devldr32.exe
C:\PROGRA~1\ADELPH~1\SMARTB~1\MotiveSB.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Netropa\OSD.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\RFA\rfagent.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\Program Files\WinFixer 2005\wfx5.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
C:\PROGRA~1\NORTON~3\NORTON~2\NPROTECT.EXE
C:\Program Files\Spam Monitor\SpamMonitor.Exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
c:\progra~1\intern~1\iexplore.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\America Online 8.0\aoltray.exe
C:\PROGRA~1\INCRED~1\bin\IMApp.exe
C:\Program Files\Corel\WordPerfect Office 2000\programs\alarm.exe
C:\Program Files\Corel\WordPerfect Office 2000\programs\dad9.exe
C:\Program Files\Aluria Software\DrSpeed Suite\drspeed.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\NORTON~3\NORTON~2\SPEEDD~1\NOPDB.EXE
C:\Program Files\WinZip\WZQKPICK.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Real\Update_OB\RealOneMessageCenter.exe
C:\WINDOWS\notepad.exe
C:\unzipped\hijackthis[1]\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.msnbc.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.ecsuhtqhewxinnudpxednccp.com/mL…Hw3SEfIy0cX.cgi
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msnbc.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.msnbc.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msnbc.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O1 - Hosts: 65.205.8.20 ad.doubleclick.net
O1 - Hosts: 208.179.9.74 blockbuster.getmyanswers.com
O1 - Hosts: 209.18.34.38 c5.zedo.com
O1 - Hosts: 64.246.50.31 cdzinc.com
O1 - Hosts: 64.39.4.129 certified-safe-downloads.com
O1 - Hosts: 66.135.216.136 cgi.ebay.com
O1 - Hosts: 216.74.132.11 clk.atdmt.com
O1 - Hosts: 64.146.132.17 count.exitexchange.com
O1 - Hosts: 192.150.14.203 createpdf.adobe.com
O1 - Hosts: 206.190.35.170 discover.yahoo.com
O1 - Hosts: 66.135.194.58 feedback.ebay.com
O1 - Hosts: 70.84.70.85 forums.tomcoyote.org
O1 - Hosts: 208.27.211.17 inetdocs.loudoun.gov
O1 - Hosts: 205.188.226.248 members.aol.com
O1 - Hosts: 66.135.218.151 my.ebay.com
O1 - Hosts: 216.113.185.41 promo.ebay.com
O1 - Hosts: 64.12.50.179 sa.payment.aol.com
O1 - Hosts: 64.191.196.56 search.atomz.com
O1 - Hosts: 66.135.194.140 search.ebay.com
O1 - Hosts: 64.139.51.147 search.freefind.com
O1 - Hosts: 198.64.142.207 secure.agoramedia.com
O1 - Hosts: 66.163.161.46 store1.yimg.com
O1 - Hosts: 64.78.193.7 www.12345cyc.com
O1 - Hosts: 192.150.19.60 www.adobe.com
O1 - Hosts: 65.88.90.51 www.agora-inc.com
O1 - Hosts: 216.154.224.25 www.autoweb.com
O1 - Hosts: 64.187.43.34 www.azoogleads.com
O1 - Hosts: 69.36.174.178 www.bestbuynonitools.com
O1 - Hosts: 69.56.244.238 www.bidwhistonline.com
O1 - Hosts: 204.9.174.123 www.capitalcommunity.org
O1 - Hosts: 199.244.218.42 www.capitalone.com
O1 - Hosts: 216.154.224.20 www.car.com
O1 - Hosts: 64.69.35.144 www.christiandebttrust.com
O1 - Hosts: 212.23.8.80 www.davehigham.zen.co.uk
O1 - Hosts: 216.70.54.91 www.dcmilitary.com
O1 - Hosts: 66.132.217.63 www.dentalplans.com
O1 - Hosts: 64.49.200.220 www.diabetes-help.com
O1 - Hosts: 67.19.3.218 www.drudge.com
O1 - Hosts: 65.77.130.210 www.drudgereport.com
O1 - Hosts: 152.3.233.7 www.duke.edu
O1 - Hosts: 66.135.192.124 www.ebay.com
O1 - Hosts: 216.144.69.200 www.ediets.com
O1 - Hosts: 69.20.59.8 www.ehow.com
O1 - Hosts: 64.187.43.30 www.extendedwarrantysavings.com
O1 - Hosts: 208.185.211.71 www.ezula.com
O1 - Hosts: 82.110.105.12 www.genealogysuccessleads.com
O1 - Hosts: 216.180.244.91 www.godlikeproductions.com
O1 - Hosts: 64.233.161.99 www.google.com
O1 - Hosts: 64.66.167.148 www.gpsoftware.com
O1 - Hosts: 216.248.192.54 www.hellocolumbus.com
O1 - Hosts: 204.3.218.38 www.incc.org
O1 - Hosts: 206.82.140.162 www.incredimail.com
O1 - Hosts: 206.14.107.195 www.letstalk.com
O1 - Hosts: 208.185.54.9 www.loadingwebsite.com
O1 - Hosts: 205.188.136.56 www.mapquest.com
O1 - Hosts: 216.34.187.114 www.mercola.com
O1 - Hosts: 207.46.18.30 www.microsoft.com
O1 - Hosts: 207.46.20.60 www.microsoft.com
O1 - Hosts: 69.36.8.40 www.mlmconsultant.com
O1 - Hosts: 207.46.245.61 www.msnbc.com
O1 - Hosts: 207.46.245.33 www.msnbc.msn.com
O1 - Hosts: 66.18.129.89 www.myganoexcel.biz
O1 - Hosts: 207.36.117.85 www.noniworks.net
O1 - Hosts: 66.212.229.233 www.partypoker.com
O1 - Hosts: 4.17.107.26 www.paulayoung.com
O1 - Hosts: 63.246.20.203 www.pcsecurityshield.com
O1 - Hosts: 209.126.138.91 www.powerrecruitingtape.com
O1 - Hosts: 65.120.217.116 www.progressivenursing.com
O1 - Hosts: 67.50.118.130 www.rapidcashproviderapp.com
O1 - Hosts: 72.22.64.19 www.registrydefender.com
O1 - Hosts: 66.235.180.45 www.searchbug.com
O1 - Hosts: 208.254.3.166 www.seeq.com
O1 - Hosts: 66.165.133.65 www.snopes.com
O1 - Hosts: 198.65.148.142 www.southbeachdiet.com
O1 - Hosts: 8.10.179.166 www.spychecker.com
O1 - Hosts: 64.49.214.42 www.spywarelabs.com
O1 - Hosts: 170.37.22.150 www.staples.com
O1 - Hosts: 157.238.218.160 www.tahitiannoni.com
O1 - Hosts: 216.94.75.140 www.thirtypluschristians.com
O1 - Hosts: 82.165.243.203 www.topgunpresentation.com
O1 - Hosts: 213.86.53.254 www.trafficexplorer.com
O1 - Hosts: 198.175.228.89 www.truthorfiction.com
O1 - Hosts: 209.157.71.50 www.ujimatheatre.homestead.com
O1 - Hosts: 66.95.94.50 www.unitedbank-va.com
O1 - Hosts: 216.139.222.234 www.venus123.com
O1 - Hosts: 66.163.161.45 www.xpcgear.com
O1 - Hosts: 64.152.128.198 yoursmartrewards.com
O1 - Hosts: 69.25.43.141 z1.adserver.com
O1 - Hosts: 216.52.81.211 zabasearch.com
O1 - Hosts: 56.0.66.49 zip4.usps.com
O1 - Hosts: 64.94.141.183 zn.ar.ediets.com
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~2\tools\iesdsg.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe
O4 - HKLM\..\Run: [AHQInit] C:\Program Files\Creative\SBLive\Program\AHQInit.exe
O4 - HKLM\..\Run: [DellTouch] C:\WINDOWS\DELLMMKB.EXE
O4 - HKLM\..\Run: [POINTER] C:\Program Files\Microsoft Hardware\Mouse\point32.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\ADELPH~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AudioHQ] C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [RFAgent] C:\Program Files\RFA\rfagent.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [WinFixer 2005] C:\Program Files\WinFixer 2005\wfx5.exe
O4 - HKLM\..\Run: [winsync] C:\WINDOWS\System32\jqraao.exe reg_run
O4 - HKCU\..\Run: [IncrediMail] C:\PROGRA~1\INCRED~1\bin\IncMail.exe /c
O4 - HKCU\..\Run: [Norton SystemWorks] "C:\Program Files\Norton SystemWorks\cfgwiz.exe" /GUID {05858CFD-5CC4-4ceb-AAAF-CF00BF39736A} /MODE CfgWiz
O4 - HKCU\..\Run: [Spam Monitor] C:\Program Files\Spam Monitor\SpamMonitor.Exe
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [license multi] C:\DOCUME~1\JACQUE~1\APPLIC~1\KNOBRE~1\Scr Cast.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Adelphia eSupport Assistant.lnk = C:\Program Files\Adelphia eSupport Assistant\bin\matcli.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: America Online Tray Icon.lnk = C:\Program Files\America Online 8.0\aoltray.exe
O4 - Global Startup: Camio Viewer 2000.lnk = C:\Program Files\Sierra Imaging\Image Expert 2000\IXApplet.exe
O4 - Global Startup: CorelCENTRAL Alarms.LNK = C:\Program Files\Corel\WordPerfect Office 2000\programs\alarm.exe
O4 - Global Startup: Desktop Application Director 9.LNK = C:\Program Files\Corel\WordPerfect Office 2000\programs\dad9.exe
O4 - Global Startup: Dr.Speed NetRx.lnk = C:\Program Files\Aluria Software\DrSpeed Suite\drspeed.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Add; animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: &Google; Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links; - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed; Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Si&milar; Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O9 - Extra button: SideStep - {3E230861-5C87-11D3-A1C6-00105A1B41B8} - C:\WINDOWS\System32\shdocvw.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.msnbc.com
O14 - IERESET.INF: MS_START_PAGE_URL=http://www.msnbc.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid;=0x409
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200305…meInstaller.exe
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secur…loadManager.ocx
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.av.aol.com/molbin/shared/m…,18/mcgdmgr.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/asa/SymAData.cab
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IMDownloader Class) - http://www2.incredimail.com/contents/setup…er/imloader.cab
O18 - Protocol: SafeAuthenticate - {8125919B-9BE9-4213-A1D6-75188A22D21E} - C:\WINDOWS\MVNFILT3.DLL
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: IMAPI CD-Burning COM Service (ImapiService) - Roxio Inc. - C:\WINDOWS\System32\ImapiRox.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Personal Firewall\ISSVC.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
O23 - Service: Netropa NHK Server (Nhksrv) - Unknown owner - C:\WINDOWS\Nhksrv.exe (file missing)
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~3\NORTON~2\NPROTECT.EXE
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~3\NORTON~2\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

Elrond

Post #21July 29, 2005, 1:47 AM UTC

Hi jacqueee

I see that you have had the LOP infection for quite a while. I found your thread at Geeks-to-Go from September 2004 and it already showed it.

OK lets see if we can get rid of everything this time. Do not give up.

Open "HijackThis". Click on "Open Misc.Tool Section".
Use the scroll bar on the right and scroll down to "Open Uninstall Manager". Click it.
On the right you will find "Save List". Click it.
The log that you just saved will appear.
Use "Copy" and "Paste" to add it to your next post.
Did you try to do the instructions in point 1 from my last post. If not do it now. It is a different address than the one you tried before so there is a good chance that Hoster will download. Then follow the instructions for running it.
I know that you did this before but the program develops very fast at the moment:
Download [url=http://www.bleepingcomputer.com/files/oldtimer/WinPFind.zip[WinPFind.zip and extract it to your C:\ folder. This will create a folder called WinPFind in the C:\ folder. Inside c:\WinPFind is a file called WinPFind.exe. Double-click on this file to launch the program. Once it is launched, click on the Start Scan button and wait for it to finish. This program will scan large amounts of files on your computer for known patterns so please be patient while it works as it can take a while, upwards to 30 minutes or more.

When it is done, it will show the results of the scan. Click on the Copy to Clipboard button and then paste the contents of the log in your clipboard into a new post in this thread.

Note: It is important to note that not all files found with this program are necessarily bad. Please use extreme caution when deleting these files as it may cause problems with applications running on your machine.

If things have worked as well as it seems I should find no traces of the second of the new infections that you have.
Run a HijackThis scan and post the new log.

jacqueee

Post #22August 9, 2005, 3:39 AM UTC

SO sorry about delay. 86 y/o mother, rushed to hospital for few days, hospice involved. If you haven't been through it, I pray you never have to. If you have been through it, I know you understand. Sorry :-(

WinPFind.TXT
WARNING: not all files found by this scanner are bad. Consult with a knowledgable person before proceeding.

If you see a message in the titlebar saying "not responding" you can ignore it. Windows is throwing this message up even though the program is still running. As long as the hard disk is working then the program is running.

»»»»»»»»»»»»»»»»»»»»»»»» Files found »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Checking %SystemDrive% folder…
UPX! C:\FixKlez.com
UPX! C:\hijackthis.exe
KavSvc C:\hijackthis.log

Checking %ProgramFilesDir% folder…

Checking %WinDir% folder…
web-nex C:\WINDOWS\IE4 Error Log.txt

Checking %System% folder…
UPX! C:\WINDOWS\system32\actskn43.ocx
PEC2 C:\WINDOWS\system32\DFRG.MSC
UPX! C:\WINDOWS\system32\locate.com
Umonitor C:\WINDOWS\system32\rasdlg.dll

Checking %System%\Drivers folder and sub-folders…
qoologic C:\WINDOWS\system32\drivers\ETC\hosts
urllogic C:\WINDOWS\system32\drivers\ETC\hosts
urllogic C:\WINDOWS\system32\drivers\ETC\hosts

Checking the Windows folder for system and hidden files within the last 60 days…
08/08/2005 C:\WINDOWS\QTFont.qfn
06/17/2005 C:\WINDOWS\Help\nocontnt.GID
08/01/2005 C:\WINDOWS\Help\Tours\WindowsMediaPlayer\Audio\Wav\WFXrepair.tmp
06/23/2005 C:\WINDOWS\INF\oem32.inf
08/08/2005 C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.LOG
08/08/2005 C:\WINDOWS\SYSTEM32\CONFIG\SAM.LOG
08/08/2005 C:\WINDOWS\SYSTEM32\CONFIG\SECURITY.LOG
08/08/2005 C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.LOG
08/08/2005 C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.LOG
07/13/2005 C:\WINDOWS\SYSTEM32\Microsoft\Protect\S-1-5-18\User\47b51558-8f7b-4fa0-bb6e-be55c5a6cabc
07/13/2005 C:\WINDOWS\SYSTEM32\Microsoft\Protect\S-1-5-18\User\Preferred
08/07/2005 C:\WINDOWS\Tasks\SA.DAT
08/08/2005 C:\WINDOWS\Tasks\{057F47AA-59E7-4308-82B4-12334A9B8E6C}_SOMERS_Jacqueline Somers.job

»»»»»»»»»»»»»»»»»»»»»»»» Checking Global Startup »»»»»»»»»»»»»»»»»»»»»»

Checking %ALLUSERSPROFILE%\Startup folder…

Checking %ALLUSERSPROFILE%\Application Data folder…

Checking %USERPROFILE%\Startup folder…

Checking %USERPROFILE%\Application Data folder…

»»»»»»»»»»»»»»»»»»»»»»»» Registry Entries Found »»»»»»»»»»»»»»»»»»»»»»»

*\shellex\ContextMenuHandlers
*\shellex\ContextMenuHandlers\Adobe.Acrobat.ContextMenu
{D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802} = C:\Program Files\Adobe\Acrobat 6.0\Acrobat Elements\ContextMenu.dll
*\shellex\ContextMenuHandlers\fsnggqnx
{dec675c5-8458-4f7e-8ece-1715f735dd20} =
*\shellex\ContextMenuHandlers\IMMenuShellExt
{F8984111-38B6-11D5-8725-0050DA2761C4} = C:\Program Files\IncrediMail\bin\IMShExt.dll
*\shellex\ContextMenuHandlers\Offline Files
{750fdf0e-2a26-11d1-a3ea-080036587f03} = %SystemRoot%\System32\cscui.dll
*\shellex\ContextMenuHandlers\Open With
{09799AFB-AD67-11d1-ABCD-00C04FC30936} = %SystemRoot%\system32\SHELL32.dll
*\shellex\ContextMenuHandlers\Open With EncryptionMenu
{A470F8CF-A1E8-4f65-8335-227475AA5C46} = %SystemRoot%\system32\SHELL32.dll
*\shellex\ContextMenuHandlers\Symantec.Norton.Antivirus.IEContextMenu
{5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2} = C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
*\shellex\ContextMenuHandlers\WinZip
{E0D79304-84BE-11CE-9641-444553540000} = C:\PROGRA~1\WINZIP\WZSHLSTB.DLL
*\shellex\ContextMenuHandlers\{a2a9545d-a0c2-42b4-9708-a0b2badd77c8}
Start Menu Pin =
*\shellex\ContextMenuHandlers\{B95057E0-44DB-11CE-A5D1-00608C83BD3F}
=

SOFTWARE\Classes\Folder\shellex\ColumnHandlers
SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{0D2E74C4-3C34-11d2-A27E-00C04FC30871}
= %SystemRoot%\system32\SHELL32.dll
SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{24F14F01-7B1C-11d1-838f-0000F80461CF}
= %SystemRoot%\system32\SHELL32.dll
SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{24F14F02-7B1C-11d1-838f-0000F80461CF}
= %SystemRoot%\system32\SHELL32.dll
SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{66742402-F9B9-11D1-A202-0000F81FEDEE}
= %SystemRoot%\system32\SHELL32.dll
SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{F9DB5320-233E-11D1-9F84-707F02C10627}
= C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Microsoft Works Update Detection C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
NvCplDaemon RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
AdaptecDirectCD "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
UpdReg C:\WINDOWS\Updreg.exe
AHQInit C:\Program Files\Creative\SBLive\Program\AHQInit.exe
DellTouch C:\WINDOWS\DELLMMKB.EXE
POINTER C:\Program Files\Microsoft Hardware\Mouse\point32.exe
Motive SmartBridge C:\PROGRA~1\ADELPH~1\SMARTB~1\MotiveSB.exe
QuickTime Task "C:\Program Files\QuickTime\qttask.exe" -atboottime
AudioHQ C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE
HP Component Manager "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
ccApp "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
SSC_UserPrompt C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
RFAgent C:\Program Files\RFA\rfagent.exe
HP Software Update "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
Symantec NetDriver Monitor C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
SunJavaUpdateSched C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents
IMAIL
MAPI
MSFS

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
IncrediMail C:\PROGRA~1\INCRED~1\bin\IncMail.exe /c
Norton SystemWorks "C:\Program Files\Norton SystemWorks\cfgwiz.exe" /GUID {05858CFD-5CC4-4ceb-AAAF-CF00BF39736A} /MODE CfgWiz
Spam Monitor C:\Program Files\Spam Monitor\SpamMonitor.Exe
Spyware Doctor "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
license multi C:\DOCUME~1\JACQUE~1\APPLIC~1\KNOBRE~1\Scr Cast.exe

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain
= crypt32.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet
= cryptnet.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll
= cscdll.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp
= wlnotify.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule
= wlnotify.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy
= sclgntfy.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn
= WlNotify.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv
= wlnotify.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon
= wlnotify.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif
= wzcdlg.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\PostBootReminder
{7849596a-48ea-486e-8937-a2a3009f31a9} = %SystemRoot%\system32\SHELL32.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\CDBurn
{fbeb8a05-beee-4442-804e-409d6c4515e9} = %SystemRoot%\system32\SHELL32.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\WebCheck
{E6FB5E20-DE35-11CF-9C87-00AA005127ED} = %SystemRoot%\System32\webcheck.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\SysTray
{35CEC8A3-2BE6-11D2-8773-92E220524153} = C:\WINDOWS\System32\stobject.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\UPnPMonitor
{e57ce738-33e8-4c51-8354-bb4de9d215d1} = C:\WINDOWS\System32\upnpui.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cqw32.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\enc98.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\front.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\install.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mngreg32.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\photohse.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\printhse.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\prwin8.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ps80.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\psdmt.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qfinder.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qpw.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setup.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setup32.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sevinst.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ua80.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wpwin8.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xwsetup.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Your Image File Name Here without a path
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\_INSTPGM.EXE

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
UserInit C:\WINDOWS\system32\userinit.exe,
Shell Explorer.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
AppInit_DLLs

»»»»»»»»»»»»»»»»»»»»»»»» Scan Complete »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
WinPFind v1.0.0.8 - Log file written to "WinPFind.Txt" in the WinPFind folder.

Uninstall_list.Txt

Ad-aware 6 Personal
Adelphia eSupport Assistant
Adobe Acrobat - Reader 6.0.2 Update
Adobe Acrobat 6.0 Standard
Adobe Acrobat 7.0.1 and Reader 7.0.1 Update
Adobe Acrobat and Reader 6.0.3 Update
Adobe Atmosphere Player for Acrobat and Adobe Reader
Adobe Download Manager 1.2 (Remove Only)
Adobe Reader 6.0.1
Adobe Reader 7.0
America Online
AnswerWorks Runtime
AOL Coach Version 1.0(Build:20020823.1)
ArcSoft PhotoImpression 3.0
Backup Dell-Installed Programs
Best Case Bankruptcy for Windows
Bid Whist Challenge
Bid Whist Challenge (C:\Program Files\Bid Whist Challenge\)
BidWhist
Browser Hijack Blaster v1.0
Card Games
CC_ccProxyExt
ccCommon
ccPxyCore
CheckIt Diagnostics
Clipboard Magic
Conexant HSF V92 56K RTAD Speakerphone PCI Modem
Copy Utility
Corel Applications
Dell Picture Studio - Image Expert 2000
Dell ResourceCD
Dell Solution Center
DELL TrueMobile 1180 Wireless USB
DellTouch
DirectX 9 Hotfix - KB839643
Dr.Speed Suite
Easy CD Creator 5 Basic
ewido security suite
Google Toolbar for Internet Explorer
HijackThis 1.99.1
HP Photo & Imaging 3.1
HP PSC & OfficeJet 3.0
HP Software Update
IncrediMail Xe
Internet Explorer Q903235
Internet Worm Protection
J2SE Runtime Environment 5.0 Update 2
Java 2 Runtime Environment, SE v1.4.2
Kiplinger's WillPower
LiveReg (Symantec Corporation)
LiveUpdate 2.6 (Symantec Corporation)
Macromedia Shockwave Player
Memories Disc Creator 2.0
Microsoft .NET Framework 1.1
Microsoft Data Access Components KB870669
Microsoft Encarta Encyclopedia Standard 2002
Microsoft Office 2000 Professional
Microsoft Office PowerPoint Viewer 2003
Microsoft Picture It! Photo 2002
Microsoft Streets and Trips 2002
Microsoft Word 2002
Microsoft Works 2002 Setup Launcher
Microsoft Works 6.0
Microsoft Works Suite Add-in for Microsoft Word
Modem Helper
MSRedist
MSRedist
Norton AntiSpam
Norton AntiVirus 2005
Norton AntiVirus Parent MSI
Norton Internet Security
Norton Internet Security
Norton Internet Security
Norton Internet Security
Norton Personal Firewall
Norton Personal Firewall
Norton Personal Firewall 2005 (Symantec Corporation)
Norton SystemWorks
Norton SystemWorks 2005 (Symantec Corporation)
Norton Utilities
Norton WMI Update
Norton WMI Update
Norton WMI Update
NSW_DRM_COLLECTION
NVIDIA Windows 2000/XP Display Drivers
OIN
overland
PCRescue v3.0
PhoneTools
QuickTime
Reader Rabbit Math Ages 6-9
RealPlayer
Registry First Aid
Registry Mechanic
Security Update for Step By Step Interactive Training (KB898458)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896422)
Security Update for Windows XP (KB896426)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB901214)
Shockwave Player
SideStep
Sound Blaster Live! Value
SPBBC
Spy Sweeper
Spybot - Search & Destroy 1.3
Spyware Doctor 3.2
SpywareBlaster v3.4
Symantec Script Blocking Installer
Symantec SCSSDist MSI
SymNet
Tax$aver Accountant
TaxCut 2002
TaxCut 2003
Update for Windows XP (KB898461)
VBRunDLL
WebDeployerSupport
WestCiteLink
Windows AFA Internet Enhancement
Windows Installer 3.1 (KB893803)
Windows Installer 3.1 (KB893803)
Windows Media Format Runtime
Windows Media Player 10
Windows Media Player Hotfix [See wm828026 for more information]
Windows XP Hotfix - KB810217
Windows XP Hotfix - KB821557
Windows XP Hotfix - KB823182
Windows XP Hotfix - KB823559
Windows XP Hotfix - KB823980
Windows XP Hotfix - KB824105
Windows XP Hotfix - KB824141
Windows XP Hotfix - KB824146
Windows XP Hotfix - KB825119
Windows XP Hotfix - KB828028
Windows XP Hotfix - KB828035
Windows XP Hotfix - KB828741
Windows XP Hotfix - KB833987
Windows XP Hotfix - KB834707
Windows XP Hotfix - KB835732
Windows XP Hotfix - KB837001
Windows XP Hotfix - KB839645
Windows XP Hotfix - KB840315
Windows XP Hotfix - KB840374
Windows XP Hotfix - KB840987
Windows XP Hotfix - KB841356
Windows XP Hotfix - KB841533
Windows XP Hotfix - KB841873
Windows XP Hotfix - KB842773
Windows XP Hotfix - KB867282
Windows XP Hotfix - KB871250
Windows XP Hotfix - KB873333
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB873376
Windows XP Hotfix - KB883939
Windows XP Hotfix - KB885250
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB888113
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB889293
Windows XP Hotfix - KB890047
Windows XP Hotfix - KB890175
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB890923
Windows XP Hotfix - KB891711
Windows XP Hotfix - KB891781
Windows XP Hotfix - KB893066
Windows XP Hotfix - KB893086
Windows XP Hotfix - KB897715
Windows XP Hotfix (SP2) [See Q329048 for more information]
Windows XP Hotfix (SP2) [See Q329115 for more information]
Windows XP Hotfix (SP2) [See Q329390 for more information]
Windows XP Hotfix (SP2) [See Q329834 for more information]
Windows XP Hotfix (SP2) Q328310
Windows XP Hotfix (SP2) Q329170
Windows XP Hotfix (SP2) Q329441
Windows XP Hotfix (SP2) Q331953
Windows XP Hotfix (SP2) Q810020
Windows XP Hotfix (SP2) Q810565
Windows XP Hotfix (SP2) Q810577
Windows XP Hotfix (SP2) Q810833
Windows XP Hotfix (SP2) Q811493
Windows XP Hotfix (SP2) Q814033
Windows XP Hotfix (SP2) Q815021
Windows XP Hotfix (SP2) Q817287
Windows XP Hotfix (SP2) Q817606
Windows XP Hotfix (SP2) Q819696
Windows XP Service Pack 1a
WinPatrol 9.5
WinZip

HiJAck This

Logfile of HijackThis v1.99.1
Scan saved at 11:30:15 PM, on 08/08/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Personal Firewall\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
C:\PROGRA~1\NORTON~3\NORTON~2\NPROTECT.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\PROGRA~1\NORTON~3\NORTON~2\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINDOWS\DELLMMKB.EXE
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\PROGRA~1\ADELPH~1\SMARTB~1\MotiveSB.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\System32\devldr32.exe
C:\Program Files\Netropa\OSD.exe
C:\Program Files\RFA\rfagent.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
c:\progra~1\intern~1\iexplore.exe
C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\America Online 8.0\aoltray.exe
C:\Program Files\Corel\WordPerfect Office 2000\programs\alarm.exe
C:\Program Files\Corel\WordPerfect Office 2000\programs\dad9.exe
C:\Program Files\Aluria Software\DrSpeed Suite\drspeed.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Adelphia eSupport Assistant\bin\mpbtn.exe
C:\WINDOWS\System32\wuauclt.exe
C:\PROGRA~1\INCRED~1\bin\IMApp.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\notepad.exe
C:\unzipped\hijackthis[1]\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.msnbc.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.ecsuhtqhewxinnudpxednccp.com/mL…Hw3SEfIy0cX.cgi
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msnbc.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.msnbc.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msnbc.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O1 - Hosts: 65.205.8.20 ad.doubleclick.net
O1 - Hosts: 65.61.157.153 adserver.softwareonline.com
O1 - Hosts: 69.30.221.10 aoreport.com
O1 - Hosts: 208.179.9.74 blockbuster.getmyanswers.com
O1 - Hosts: 209.18.34.38 c5.zedo.com
O1 - Hosts: 64.246.50.31 cdzinc.com
O1 - Hosts: 64.39.4.129 certified-safe-downloads.com
O1 - Hosts: 66.135.216.136 cgi.ebay.com
O1 - Hosts: 216.74.132.11 clk.atdmt.com
O1 - Hosts: 64.146.132.17 count.exitexchange.com
O1 - Hosts: 192.150.14.203 createpdf.adobe.com
O1 - Hosts: 206.190.35.170 discover.yahoo.com
O1 - Hosts: 69.72.234.82 drizzten.com
O1 - Hosts: 65.202.230.12 email.flyi.com
O1 - Hosts: 168.215.86.180 etips.dummies.com
O1 - Hosts: 209.202.240.100 family95fs.tripod.com
O1 - Hosts: 66.135.194.58 feedback.ebay.com
O1 - Hosts: 70.84.70.85 forums.tomcoyote.org
O1 - Hosts: 159.153.235.1 game1.pogo.com
O1 - Hosts: 141.106.50.18 healthlink.mcw.edu
O1 - Hosts: 208.183.128.3 host128-3.jefferson-hs.jefferson.k12tn.net
O1 - Hosts: 208.183.128.8 host128-8.jefferson-hs.jefferson.k12tn.net
O1 - Hosts: 208.27.211.17 inetdocs.loudoun.gov
O1 - Hosts: 217.112.42.35 kochugov.ru
O1 - Hosts: 66.109.247.70 local.lancasteronline.com
O1 - Hosts: 65.17.206.86 loudoun-homes.com
O1 - Hosts: 206.16.201.10 marriott.com
O1 - Hosts: 66.48.79.6 mediresource.sympatico.ca
O1 - Hosts: 205.188.226.248 members.aol.com
O1 - Hosts: 64.59.134.11 members.shaw.ca
O1 - Hosts: 209.197.89.145 merica.com
O1 - Hosts: 66.135.218.151 my.ebay.com
O1 - Hosts: 64.151.84.133 news.surfwax.com
O1 - Hosts: 128.187.8.240 newsnet.byu.edu
O1 - Hosts: 216.113.185.41 promo.ebay.com
O1 - Hosts: 66.54.16.80 res.nwa.com
O1 - Hosts: 64.12.50.179 sa.payment.aol.com
O1 - Hosts: 64.191.196.56 search.atomz.com
O1 - Hosts: 66.135.194.140 search.ebay.com
O1 - Hosts: 64.139.51.147 search.freefind.com
O1 - Hosts: 65.214.43.37 searchwin2000.techtarget.com
O1 - Hosts: 198.64.142.207 secure.agoramedia.com
O1 - Hosts: 66.163.161.46 store1.yimg.com
O1 - Hosts: 216.136.179.155 supersearch.travelzoo.com
O1 - Hosts: 207.46.248.248 support.microsoft.com
O1 - Hosts: 140.177.205.40 support.wolfram.com
O1 - Hosts: 66.39.96.124 tattooflash.info
O1 - Hosts: 192.216.212.140 tickets.airtran.com
O1 - Hosts: 64.56.194.84 top20.travelzoo.com
O1 - Hosts: 63.241.243.20 travelnow.com
O1 - Hosts: 69.7.172.160 valoans.com
O1 - Hosts: 155.43.4.81 webster.commnet.edu
O1 - Hosts: 206.18.109.68 wichita.hyatt.com
O1 - Hosts: 64.14.56.90 www.10tv.com
O1 - Hosts: 64.78.193.7 www.12345cyc.com
O1 - Hosts: 216.41.21.195 www.211.org
O1 - Hosts: 207.150.192.12 www.22svssq.org
O1 - Hosts: 208.35.255.102 www.341services.com
O1 - Hosts: 208.35.133.8 www.aafp.org
O1 - Hosts: 69.44.154.8 www.aaregistry.com
O1 - Hosts: 170.109.254.5 www.aarp.org
O1 - Hosts: 192.150.19.60 www.adobe.com
O1 - Hosts: 65.88.90.51 www.agora-inc.com
O1 - Hosts: 192.216.212.230 www.airtran.com
O1 - Hosts: 66.209.79.21 www.allegiantair.com
O1 - Hosts: 12.47.205.85 www.americawest.com
O1 - Hosts: 192.197.97.58 www.asiancanadian.net
O1 - Hosts: 216.154.224.25 www.autoweb.com
O1 - Hosts: 69.5.5.30 www.awitness.org
O1 - Hosts: 64.187.43.34 www.azoogleads.com
O1 - Hosts: 171.159.65.173 www.bankofamerica.com
O1 - Hosts: 69.36.174.178 www.bestbuynonitools.com
O1 - Hosts: 69.56.244.238 www.bidwhistonline.com
O1 - Hosts: 66.152.98.205 www.blackengineer.com
O1 - Hosts: 216.213.19.27 www.bleepingcomputer.com
O1 - Hosts: 69.25.205.40 www.bookingbuddy.com
O1 - Hosts: 64.111.105.189 www.brendoman.com
O1 - Hosts: 68.16.91.42 www.bynouveau.com
O1 - Hosts: 216.92.166.21 www.calcompnutrition.com
O1 - Hosts: 204.9.174.123 www.capitalcommunity.org
O1 - Hosts: 199.244.218.42 www.capitalone.com
O1 - Hosts: 216.154.224.20 www.car.com
O1 - Hosts: 66.40.10.43 www.carepathways.com
O1 - Hosts: 64.14.85.66 www.carescout.com
O1 - Hosts: 209.18.34.46 www.channelcincinnati.com
O1 - Hosts: 198.151.61.105 www.cheaptickets.com
O1 - Hosts: 64.69.35.144 www.christiandebttrust.com
O1 - Hosts: 192.193.226.190 www.citibank.com
O1 - Hosts: 64.83.52.104 www.consumeraffairs.com
O1 - Hosts: 208.190.112.36 www.continental.com
O1 - Hosts: 212.23.8.80 www.davehigham.zen.co.uk
O1 - Hosts: 216.70.54.91 www.dcmilitary.com
O1 - Hosts: 205.174.16.50 www.delta.com
O1 - Hosts: 66.132.217.63 www.dentalplans.com
O1 - Hosts: 64.49.200.220 www.diabetes-help.com
O1 - Hosts: 209.191.22.27 www.directbuy.com
O1 - Hosts: 67.19.3.218 www.drudge.com
O1 - Hosts: 65.77.130.210 www.drudgereport.com
O1 - Hosts: 205.141.206.227 www.drugdigest.org
O1 - Hosts: 152.3.233.7 www.duke.edu
O1 - Hosts: 209.191.22.23 www.dynamicappointment.com
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~2\tools\iesdsg.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe
O4 - HKLM\..\Run: [AHQInit] C:\Program Files\Creative\SBLive\Program\AHQInit.exe
O4 - HKLM\..\Run: [DellTouch] C:\WINDOWS\DELLMMKB.EXE
O4 - HKLM\..\Run: [POINTER] C:\Program Files\Microsoft Hardware\Mouse\point32.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\ADELPH~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AudioHQ] C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [RFAgent] C:\Program Files\RFA\rfagent.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKCU\..\Run: [IncrediMail] C:\PROGRA~1\INCRED~1\bin\IncMail.exe /c
O4 - HKCU\..\Run: [Norton SystemWorks] "C:\Program Files\Norton SystemWorks\cfgwiz.exe" /GUID {05858CFD-5CC4-4ceb-AAAF-CF00BF39736A} /MODE CfgWiz
O4 - HKCU\..\Run: [Spam Monitor] C:\Program Files\Spam Monitor\SpamMonitor.Exe
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [license multi] C:\DOCUME~1\JACQUE~1\APPLIC~1\KNOBRE~1\Scr Cast.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Adelphia eSupport Assistant.lnk = C:\Program Files\Adelphia eSupport Assistant\bin\matcli.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: America Online Tray Icon.lnk = C:\Program Files\America Online 8.0\aoltray.exe
O4 - Global Startup: Camio Viewer 2000.lnk = C:\Program Files\Sierra Imaging\Image Expert 2000\IXApplet.exe
O4 - Global Startup: CorelCENTRAL Alarms.LNK = C:\Program Files\Corel\WordPerfect Office 2000\programs\alarm.exe
O4 - Global Startup: Desktop Application Director 9.LNK = C:\Program Files\Corel\WordPerfect Office 2000\programs\dad9.exe
O4 - Global Startup: Dr.Speed NetRx.lnk = C:\Program Files\Aluria Software\DrSpeed Suite\drspeed.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Si&milar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O9 - Extra button: SideStep - {3E230861-5C87-11D3-A1C6-00105A1B41B8} - C:\WINDOWS\System32\shdocvw.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.msnbc.com
O14 - IERESET.INF: MS_START_PAGE_URL=http://www.msnbc.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid;=0x409
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200305…meInstaller.exe
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secur…loadManager.ocx
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.av.aol.com/molbin/shared/m…,18/mcgdmgr.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/asa/SymAData.cab
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IMDownloader Class) - http://www2.incredimail.com/contents/setup…er/imloader.cab
O18 - Protocol: SafeAuthenticate - {8125919B-9BE9-4213-A1D6-75188A22D21E} - C:\WINDOWS\MVNFILT3.DLL
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: IMAPI CD-Burning COM Service (ImapiService) - Roxio Inc. - C:\WINDOWS\System32\ImapiRox.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Personal Firewall\ISSVC.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
O23 - Service: Netropa NHK Server (Nhksrv) - Unknown owner - C:\WINDOWS\Nhksrv.exe (file missing)
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~3\NORTON~2\NPROTECT.EXE
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~3\NORTON~2\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

Thank you for all your time and patience!!

Elrond

Post #23August 9, 2005, 4:36 PM UTC

Hi jacqueee

No problem. Sorry to hear that you have this sort of problem. I have had similar experiences with my parents. Lost both of them in the last 3 years.

I am not sure but we have found that SpywareDoctor sometimes blocks the fixes. This could be the reason why we can not get rid of what is left of the infection.

Please disable Spyware Doctor, as it may interfere with the fix. To disable Spyware Doctor:
- Click the Spyware Doctor icon in the System Tray.
- Click Settings.
- Click Startup Settings under Pick a Category.
- Uncheck Run at Windows startup.
- Click Apply and Exit Spyware Doctor
Once your log is clean you can re-enable Spyware Doctor.
Disable Ewido real time protection. It can also interfere with the fixes.From the system tray:
Right-click the system tray icon and uncheck real time protection.

or

From within Ewido -
Under 'Your security status', if the real time protection is active, deactivate it by clicking 'real time protection' until the status says 'inactive'.
Use the Add/Remove Programs to remove SideStep.
- Click on Start.
- Click on Control Panel.
- If you need to, click on "Switch to classic view"
- Double-click on the Add/Remove Programs icon.
- Select the SideStep Application if you find it.
- Click on the Add/Remove button.
- Once the program has uninstalled, click on the OK button.
Reboot the computer.
Open HijackThis and click "Do a System Scan Only". (If HijackThis shows a "Scan" button that is OK.) When the scan is finished put a check mark by the items that are listed in below. If you can not find an item just continue but inform me with your next post. Do not click fix until instructed to do so:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.ecsuhtqhewxinnudpxednccp.com/mL…Hw3SEfIy0cX.cg
O1 - Hosts: 65.205.8.20 ad.doubleclick.net
O1 - Hosts: 65.61.157.153 adserver.softwareonline.com
O1 - Hosts: 69.30.221.10 aoreport.com
O1 - Hosts: 208.179.9.74 blockbuster.getmyanswers.com
O1 - Hosts: 209.18.34.38 c5.zedo.com
O1 - Hosts: 64.246.50.31 cdzinc.com
O1 - Hosts: 64.39.4.129 certified-safe-downloads.com
O1 - Hosts: 66.135.216.136 cgi.ebay.com
O1 - Hosts: 216.74.132.11 clk.atdmt.com
O1 - Hosts: 64.146.132.17 count.exitexchange.com
O1 - Hosts: 192.150.14.203 createpdf.adobe.com
O1 - Hosts: 206.190.35.170 discover.yahoo.com
O1 - Hosts: 69.72.234.82 drizzten.com
O1 - Hosts: 65.202.230.12 email.flyi.com
O1 - Hosts: 168.215.86.180 etips.dummies.com
O1 - Hosts: 209.202.240.100 family95fs.tripod.com
O1 - Hosts: 66.135.194.58 feedback.ebay.com
O1 - Hosts: 70.84.70.85 forums.tomcoyote.org
O1 - Hosts: 159.153.235.1 game1.pogo.com
O1 - Hosts: 141.106.50.18 healthlink.mcw.edu
O1 - Hosts: 208.183.128.3 host128-3.jefferson-hs.jefferson.k12tn.net
O1 - Hosts: 208.183.128.8 host128-8.jefferson-hs.jefferson.k12tn.net
O1 - Hosts: 208.27.211.17 inetdocs.loudoun.gov
O1 - Hosts: 217.112.42.35 kochugov.ru
O1 - Hosts: 66.109.247.70 local.lancasteronline.com
O1 - Hosts: 65.17.206.86 loudoun-homes.com
O1 - Hosts: 206.16.201.10 marriott.com
O1 - Hosts: 66.48.79.6 mediresource.sympatico.ca
O1 - Hosts: 205.188.226.248 members.aol.com
O1 - Hosts: 64.59.134.11 members.shaw.ca
O1 - Hosts: 209.197.89.145 merica.com
O1 - Hosts: 66.135.218.151 my.ebay.com
O1 - Hosts: 64.151.84.133 news.surfwax.com
O1 - Hosts: 128.187.8.240 newsnet.byu.edu
O1 - Hosts: 216.113.185.41 promo.ebay.com
O1 - Hosts: 66.54.16.80 res.nwa.com
O1 - Hosts: 64.12.50.179 sa.payment.aol.com
O1 - Hosts: 64.191.196.56 search.atomz.com
O1 - Hosts: 66.135.194.140 search.ebay.com
O1 - Hosts: 64.139.51.147 search.freefind.com
O1 - Hosts: 65.214.43.37 searchwin2000.techtarget.com
O1 - Hosts: 198.64.142.207 secure.agoramedia.com
O1 - Hosts: 66.163.161.46 store1.yimg.com
O1 - Hosts: 216.136.179.155 supersearch.travelzoo.com
O1 - Hosts: 207.46.248.248 support.microsoft.com
O1 - Hosts: 140.177.205.40 support.wolfram.com
O1 - Hosts: 66.39.96.124 tattooflash.info
O1 - Hosts: 192.216.212.140 tickets.airtran.com
O1 - Hosts: 64.56.194.84 top20.travelzoo.com
O1 - Hosts: 63.241.243.20 travelnow.com
O1 - Hosts: 69.7.172.160 valoans.com
O1 - Hosts: 155.43.4.81 webster.commnet.edu
O1 - Hosts: 206.18.109.68 wichita.hyatt.com
O1 - Hosts: 64.14.56.90 www.10tv.com
O1 - Hosts: 64.78.193.7 www.12345cyc.com
O1 - Hosts: 216.41.21.195 www.211.org
O1 - Hosts: 207.150.192.12 www.22svssq.org
O1 - Hosts: 208.35.255.102 www.341services.com
O1 - Hosts: 208.35.133.8 www.aafp.org
O1 - Hosts: 69.44.154.8 www.aaregistry.com
O1 - Hosts: 170.109.254.5 www.aarp.org
O1 - Hosts: 192.150.19.60 www.adobe.com
O1 - Hosts: 65.88.90.51 www.agora-inc.com
O1 - Hosts: 192.216.212.230 www.airtran.com
O1 - Hosts: 66.209.79.21 www.allegiantair.com
O1 - Hosts: 12.47.205.85 www.americawest.com
O1 - Hosts: 192.197.97.58 www.asiancanadian.net
O1 - Hosts: 216.154.224.25 www.autoweb.com
O1 - Hosts: 69.5.5.30 www.awitness.org
O1 - Hosts: 64.187.43.34 www.azoogleads.com
O1 - Hosts: 171.159.65.173 www.bankofamerica.com
O1 - Hosts: 69.36.174.178 www.bestbuynonitools.com
O1 - Hosts: 69.56.244.238 www.bidwhistonline.com
O1 - Hosts: 66.152.98.205 www.blackengineer.com
O1 - Hosts: 216.213.19.27 www.bleepingcomputer.com
O1 - Hosts: 69.25.205.40 www.bookingbuddy.com
O1 - Hosts: 64.111.105.189 www.brendoman.com
O1 - Hosts: 68.16.91.42 www.bynouveau.com
O1 - Hosts: 216.92.166.21 www.calcompnutrition.com
O1 - Hosts: 204.9.174.123 www.capitalcommunity.org
O1 - Hosts: 199.244.218.42 www.capitalone.com
O1 - Hosts: 216.154.224.20 www.car.com
O1 - Hosts: 66.40.10.43 www.carepathways.com
O1 - Hosts: 64.14.85.66 www.carescout.com
O1 - Hosts: 209.18.34.46 www.channelcincinnati.com
O1 - Hosts: 198.151.61.105 www.cheaptickets.com
O1 - Hosts: 64.69.35.144 www.christiandebttrust.com
O1 - Hosts: 192.193.226.190 www.citibank.com
O1 - Hosts: 64.83.52.104 www.consumeraffairs.com
O1 - Hosts: 208.190.112.36 www.continental.com
O1 - Hosts: 212.23.8.80 www.davehigham.zen.co.uk
O1 - Hosts: 216.70.54.91 www.dcmilitary.com
O1 - Hosts: 205.174.16.50 www.delta.com
O1 - Hosts: 66.132.217.63 www.dentalplans.com
O1 - Hosts: 64.49.200.220 www.diabetes-help.com
O1 - Hosts: 209.191.22.27 www.directbuy.com
O1 - Hosts: 67.19.3.218 www.drudge.com
O1 - Hosts: 65.77.130.210 www.drudgereport.com
O1 - Hosts: 205.141.206.227 www.drugdigest.org
O1 - Hosts: 152.3.233.7 www.duke.edu
O1 - Hosts: 209.191.22.23 www.dynamicappointment.com
O4 - HKCU\..\Run: [license multi] C:\DOCUME~1\JACQUE~1\APPLIC~1\KNOBRE~1\Scr Cast.exe

The following items are OPTIONAL and can be fixed by putting a check mark by each line. By fixing it you can shorten boot-up time and free up resources. You will not harm your program by doing this and you will still be able to start it manually via the start-button. It is your choice, so you must decide whether you want to get rid of it or not.

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
This program places an icon in the system tray for quick access to Apple QuickTime. It is not necessary since QuickTime may be run manually even without the tray icon. If you choose to remove it, you will also have to disable it from within QuickTime, in the following manner:

1) Run QuickTime from the Start -> Programs menu
2) Click on the Edit menu, then Preferences
3) Select QuickTime Preferences from the right-hand side menu
4) Uncheck the box next to "QuickTime System Tray Icon", and click OK.

Close all open windows except HijackThis and then click the "Fix checked" button.
* Close ALL windows except "HijackThis"
* SCAN with "HijackThis"
* POST the new log in this thread using "Add Reply"

jacqueee

Post #24August 9, 2005, 6:41 PM UTC

Hello! Here is the latest scan. The Add/Remove program will not allow me to remove Sidestep. The Sidestep line/area turns dark blue when I click it but stays there! :-(

Logfile of HijackThis v1.99.1
Scan saved at 2:25:15 PM, on 08/09/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Personal Firewall\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
C:\PROGRA~1\NORTON~3\NORTON~2\NPROTECT.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\PROGRA~1\NORTON~3\NORTON~2\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINDOWS\DELLMMKB.EXE
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\PROGRA~1\ADELPH~1\SMARTB~1\MotiveSB.exe
C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE
C:\WINDOWS\System32\devldr32.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\RFA\rfagent.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Netropa\OSD.exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
c:\progra~1\intern~1\iexplore.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe
C:\Program Files\America Online 8.0\aoltray.exe
C:\Program Files\Corel\WordPerfect Office 2000\programs\alarm.exe
C:\Program Files\Corel\WordPerfect Office 2000\programs\dad9.exe
C:\Program Files\Aluria Software\DrSpeed Suite\drspeed.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\PROGRA~1\INCRED~1\bin\IMApp.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Adelphia eSupport Assistant\bin\mpbtn.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\WINDOWS\System32\wuauclt.exe
C:\unzipped\hijackthis[1]\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.msnbc.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.szenybfbgblioydih.com/mLXJm_QYS…3w3SEfIy0cX.jpg
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msnbc.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.msnbc.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msnbc.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O1 - Hosts: 205.196.223.113 www.funkytoad.com
O1 - Hosts: 64.233.161.99 www.google.com
O1 - Hosts: 204.3.218.38 www.incc.org
O1 - Hosts: 206.82.140.162 www.incredimail.com
O1 - Hosts: 209.249.116.139 www.java.com
O1 - Hosts: 216.34.187.114 www.mercola.com
O1 - Hosts: 207.46.245.33 www.msnbc.msn.com
O1 - Hosts: 204.246.128.28 www.noni.com
O1 - Hosts: 64.27.20.102 www.noniland.com
O1 - Hosts: 207.36.117.85 www.noniworks.net
O1 - Hosts: 63.246.20.203 www.pcsecurityshield.com
O1 - Hosts: 209.126.138.91 www.powerrecruitingtape.com
O1 - Hosts: 72.22.64.19 www.registrydefender.com
O1 - Hosts: 64.27.20.104 www.sample.nonijade.com
O1 - Hosts: 66.235.180.45 www.searchbug.com
O1 - Hosts: 66.165.133.65 www.snopes.com
O1 - Hosts: 157.238.218.160 www.tahitiannoni.com
O1 - Hosts: 63.249.174.188 www.texemarrs.com
O1 - Hosts: 82.165.243.203 www.topgunpresentation.com
O1 - Hosts: 64.19.148.173 www.ucctotalhome.com
O1 - Hosts: 209.87.112.90 www.united.com
O1 - Hosts: 216.189.255.247 www.unitedbank.com
O1 - Hosts: 66.95.94.50 www.unitedbank-va.com
O1 - Hosts: 212.61.24.138 www.unitedconsumers.com
O1 - Hosts: 67.18.230.132 www.usgennet.org
O1 - Hosts: 209.215.174.103 www.wcpo.com
O1 - Hosts: 66.244.254.63 www.winfixer.com
O1 - Hosts: 66.163.161.45 www.xpcgear.com
O1 - Hosts: 131.44.195.37 www-p.afsv.af.mil
O1 - Hosts: 64.152.128.198 yoursmartrewards.com
O1 - Hosts: 216.52.81.211 zabasearch.com
O1 - Hosts: 56.0.66.49 zip4.usps.com
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~2\tools\iesdsg.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe
O4 - HKLM\..\Run: [AHQInit] C:\Program Files\Creative\SBLive\Program\AHQInit.exe
O4 - HKLM\..\Run: [DellTouch] C:\WINDOWS\DELLMMKB.EXE
O4 - HKLM\..\Run: [POINTER] C:\Program Files\Microsoft Hardware\Mouse\point32.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\ADELPH~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [AudioHQ] C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [RFAgent] C:\Program Files\RFA\rfagent.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKCU\..\Run: [IncrediMail] C:\PROGRA~1\INCRED~1\bin\IncMail.exe /c
O4 - HKCU\..\Run: [Norton SystemWorks] "C:\Program Files\Norton SystemWorks\cfgwiz.exe" /GUID {05858CFD-5CC4-4ceb-AAAF-CF00BF39736A} /MODE CfgWiz
O4 - HKCU\..\Run: [license multi] C:\DOCUME~1\JACQUE~1\APPLIC~1\KNOBRE~1\Scr Cast.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Adelphia eSupport Assistant.lnk = C:\Program Files\Adelphia eSupport Assistant\bin\matcli.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: America Online Tray Icon.lnk = C:\Program Files\America Online 8.0\aoltray.exe
O4 - Global Startup: Camio Viewer 2000.lnk = C:\Program Files\Sierra Imaging\Image Expert 2000\IXApplet.exe
O4 - Global Startup: CorelCENTRAL Alarms.LNK = C:\Program Files\Corel\WordPerfect Office 2000\programs\alarm.exe
O4 - Global Startup: Desktop Application Director 9.LNK = C:\Program Files\Corel\WordPerfect Office 2000\programs\dad9.exe
O4 - Global Startup: Dr.Speed NetRx.lnk = C:\Program Files\Aluria Software\DrSpeed Suite\drspeed.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Si&milar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.msnbc.com
O14 - IERESET.INF: MS_START_PAGE_URL=http://www.msnbc.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200305…meInstaller.exe
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secur…loadManager.ocx
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.av.aol.com/molbin/shared/m…,18/mcgdmgr.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/asa/SymAData.cab
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IMDownloader Class) - http://www2.incredimail.com/contents/setup…er/imloader.cab
O18 - Protocol: SafeAuthenticate - {8125919B-9BE9-4213-A1D6-75188A22D21E} - C:\WINDOWS\MVNFILT3.DLL
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: IMAPI CD-Burning COM Service (ImapiService) - Roxio Inc. - C:\WINDOWS\System32\ImapiRox.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Personal Firewall\ISSVC.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
O23 - Service: Netropa NHK Server (Nhksrv) - Unknown owner - C:\WINDOWS\Nhksrv.exe (file missing)
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~3\NORTON~2\NPROTECT.EXE
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~3\NORTON~2\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

Thank you!!

Elrond

Post #25August 9, 2005, 8:36 PM UTC

Hi jacqueee

I can see that you have disabled SpywareDoctor.

However Ewido is still running. We will temporarely disable it.

Open HiJackThis, click "Open the Misc Tools Section", and click "Open process manager". Highlight C:\Program Files\ewido\security suite\ewidoctrl.exe if it is there and click "kill Process".
Repeat for C:\Program Files\Aluria Software\DrSpeed Suite\drspeed.exe. Do not kill any other process

Open HijackThis and click "Do a System Scan Only" or "Scan". Put a check mark by the items that are listed below.
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.szenybfbgblioydih.com/mLXJm_QYS…3w3SEfIy0cX.jpg
O1 - Hosts: 205.196.223.113 www.funkytoad.com
O1 - Hosts: 64.233.161.99 www.google.com
O1 - Hosts: 204.3.218.38 www.incc.org
O1 - Hosts: 206.82.140.162 www.incredimail.com
O1 - Hosts: 209.249.116.139 www.java.com
O1 - Hosts: 216.34.187.114 www.mercola.com
O1 - Hosts: 207.46.245.33 www.msnbc.msn.com
O1 - Hosts: 204.246.128.28 www.noni.com
O1 - Hosts: 64.27.20.102 www.noniland.com
O1 - Hosts: 207.36.117.85 www.noniworks.net
O1 - Hosts: 63.246.20.203 www.pcsecurityshield.com
O1 - Hosts: 209.126.138.91 www.powerrecruitingtape.com
O1 - Hosts: 72.22.64.19 www.registrydefender.com
O1 - Hosts: 64.27.20.104 www.sample.nonijade.com
O1 - Hosts: 66.235.180.45 www.searchbug.com
O1 - Hosts: 66.165.133.65 www.snopes.com
O1 - Hosts: 157.238.218.160 www.tahitiannoni.com
O1 - Hosts: 63.249.174.188 www.texemarrs.com
O1 - Hosts: 82.165.243.203 www.topgunpresentation.com
O1 - Hosts: 64.19.148.173 www.ucctotalhome.com
O1 - Hosts: 209.87.112.90 www.united.com
O1 - Hosts: 216.189.255.247 www.unitedbank.com
O1 - Hosts: 66.95.94.50 www.unitedbank-va.com
O1 - Hosts: 212.61.24.138 www.unitedconsumers.com
O1 - Hosts: 67.18.230.132 www.usgennet.org
O1 - Hosts: 209.215.174.103 www.wcpo.com
O1 - Hosts: 66.244.254.63 www.winfixer.com
O1 - Hosts: 66.163.161.45 www.xpcgear.com
O1 - Hosts: 131.44.195.37 www-p.afsv.af.mil
O1 - Hosts: 64.152.128.198 yoursmartrewards.com
O1 - Hosts: 216.52.81.211 zabasearch.com
O1 - Hosts: 56.0.66.49 zip4.usps.com
O4 - HKCU\..\Run: [license multi] C:\DOCUME~1\JACQUE~1\APPLIC~1\KNOBRE~1\Scr Cast.exe

Close all open windows except HijackThis and then click the "Fix checked" button.

* Close ALL windows except "HijackThis"
* SCAN with "HijackThis"
* POST the new log in this thread using "Add Reply"

E

jacqueee

Post #26August 9, 2005, 11:48 PM UTC

Hello!
I followed your instructions but for some reason, whenever I 'fix checked' after running hijack, more old programs that were 'fixed' keep coming back. There was a message about the file being large and suggesting it might be better to delete than fix. I wonder if I have something open that doesn't allow the changes to remain in place! :-(

Latest log

Logfile of HijackThis v1.99.1
Scan saved at 7:37:21 PM, on 08/09/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Personal Firewall\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
C:\PROGRA~1\NORTON~3\NORTON~2\NPROTECT.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\PROGRA~1\NORTON~3\NORTON~2\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINDOWS\DELLMMKB.EXE
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\PROGRA~1\ADELPH~1\SMARTB~1\MotiveSB.exe
C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE
C:\WINDOWS\System32\devldr32.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\RFA\rfagent.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Netropa\OSD.exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
c:\progra~1\intern~1\iexplore.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe
C:\Program Files\America Online 8.0\aoltray.exe
C:\Program Files\Corel\WordPerfect Office 2000\programs\alarm.exe
C:\Program Files\Corel\WordPerfect Office 2000\programs\dad9.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\PROGRA~1\INCRED~1\bin\IMApp.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Adelphia eSupport Assistant\bin\mpbtn.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\WINDOWS\System32\wuauclt.exe
C:\PROGRA~1\SPYWAR~2\swdoctor.exe
C:\PROGRA~1\INCRED~1\bin\ImNotfy.exe
C:\unzipped\hijackthis[1]\HijackThis.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\OPScan.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.msnbc.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.rnuspqndluglnulxeplfdox.com/mLX…w3SEfIy0cX.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msnbc.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.msnbc.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msnbc.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O1 - Hosts: 208.185.54.9 www.loadingwebsite.com
O1 - Hosts: 206.82.196.19 www.military-travel.net
O1 - Hosts: 82.165.243.203 www.topgunpresentation.com
O1 - Hosts: 216.201.96.68 www.torontofreepress.com
O1 - Hosts: 213.86.53.254 www.trafficexplorer.com
O1 - Hosts: 64.56.194.87 www.travelzoo.com
O1 - Hosts: 198.175.228.89 www.truthorfiction.com
O1 - Hosts: 64.19.148.173 www.ucctotalhome.com
O1 - Hosts: 209.157.71.50 www.ujimatheatre.homestead.com
O1 - Hosts: 209.87.112.90 www.united.com
O1 - Hosts: 216.189.255.247 www.unitedbank.com
O1 - Hosts: 66.95.94.50 www.unitedbank-va.com
O1 - Hosts: 212.61.24.138 www.unitedconsumers.com
O1 - Hosts: 67.18.230.132 www.usgennet.org
O1 - Hosts: 216.139.222.234 www.venus123.com
O1 - Hosts: 206.61.136.34 www.victoriassecret.com
O1 - Hosts: 209.215.174.103 www.wcpo.com
O1 - Hosts: 65.163.26.80 www.wichitalinks.com
O1 - Hosts: 66.244.254.63 www.winfixer.com
O1 - Hosts: 66.163.161.45 www.xpcgear.com
O1 - Hosts: 63.160.206.40 www2.nurseweek.com
O1 - Hosts: 131.44.195.37 www-p.afsv.af.mil
O1 - Hosts: 64.152.128.198 yoursmartrewards.com
O1 - Hosts: 69.25.43.141 z1.adserver.com
O1 - Hosts: 216.52.81.211 zabasearch.com
O1 - Hosts: 56.0.66.49 zip4.usps.com
O1 - Hosts: 64.94.141.183 zn.ar.ediets.com
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~2\tools\iesdsg.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe
O4 - HKLM\..\Run: [AHQInit] C:\Program Files\Creative\SBLive\Program\AHQInit.exe
O4 - HKLM\..\Run: [DellTouch] C:\WINDOWS\DELLMMKB.EXE
O4 - HKLM\..\Run: [POINTER] C:\Program Files\Microsoft Hardware\Mouse\point32.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\ADELPH~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [AudioHQ] C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [RFAgent] C:\Program Files\RFA\rfagent.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKCU\..\Run: [IncrediMail] C:\PROGRA~1\INCRED~1\bin\IncMail.exe /c
O4 - HKCU\..\Run: [Norton SystemWorks] "C:\Program Files\Norton SystemWorks\cfgwiz.exe" /GUID {05858CFD-5CC4-4ceb-AAAF-CF00BF39736A} /MODE CfgWiz
O4 - HKCU\..\Run: [Spyware Doctor] C:\PROGRA~1\SPYWAR~2\swdoctor.exe /Q
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Adelphia eSupport Assistant.lnk = C:\Program Files\Adelphia eSupport Assistant\bin\matcli.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: America Online Tray Icon.lnk = C:\Program Files\America Online 8.0\aoltray.exe
O4 - Global Startup: Camio Viewer 2000.lnk = C:\Program Files\Sierra Imaging\Image Expert 2000\IXApplet.exe
O4 - Global Startup: CorelCENTRAL Alarms.LNK = C:\Program Files\Corel\WordPerfect Office 2000\programs\alarm.exe
O4 - Global Startup: Desktop Application Director 9.LNK = C:\Program Files\Corel\WordPerfect Office 2000\programs\dad9.exe
O4 - Global Startup: Dr.Speed NetRx.lnk = C:\Program Files\Aluria Software\DrSpeed Suite\drspeed.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Si&milar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.msnbc.com
O14 - IERESET.INF: MS_START_PAGE_URL=http://www.msnbc.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200305…meInstaller.exe
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secur…loadManager.ocx
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.av.aol.com/molbin/shared/m…,18/mcgdmgr.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/asa/SymAData.cab
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IMDownloader Class) - http://www2.incredimail.com/contents/setup…er/imloader.cab
O18 - Protocol: SafeAuthenticate - {8125919B-9BE9-4213-A1D6-75188A22D21E} - C:\WINDOWS\MVNFILT3.DLL
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: IMAPI CD-Burning COM Service (ImapiService) - Roxio Inc. - C:\WINDOWS\System32\ImapiRox.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Personal Firewall\ISSVC.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
O23 - Service: Netropa NHK Server (Nhksrv) - Unknown owner - C:\WINDOWS\Nhksrv.exe (file missing)
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~3\NORTON~2\NPROTECT.EXE
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~3\NORTON~2\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

Elrond

Post #27August 10, 2005, 12:29 AM UTC

That is exactly what I have been trying to close for the last two or three rounds. I am going to ask some of the experts about this one because it does not behave as I would have expected.

Elrond

Post #28August 10, 2005, 8:20 PM UTC

Hi again jacqueee

Let's see if the following has any positive effect.

Open HiJackThis, click "Open the Misc Tools Section", and click "Open process manager". Highlight C:\PROGRA~1\SPYWAR~2\swdoctor.exe if it is there and click "kill Process".
Repeat the process for C:\Program Files\Aluria Software\DrSpeed Suite\drspeed.exe and C:\Program Files\ewido\security suite\ewidoctrl.exe
Do not kill any other process
Please disable Spyware Doctor, as it may interfere with the fix. To disable Spyware Doctor:
- Click the Spyware Doctor icon in the System Tray.
- Click Settings.
- Click Startup Settings under Pick a Category.
- Uncheck Run at Windows startup.
- Click Apply and Exit Spyware Doctor
Once your log is clean you can re-enable Spyware Doctor.
Download the LOP uninstaller from the link below run it and post a new log please.

http://www.thespykiller.co.uk/downloads.htm
Open HijackThis and click "Do a System Scan Only" or "Scan". Put a check mark by the items that are listed below if it exists.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.szenybfbgblioydih.com/mLXJm_QYS…3w3SEfIy0cX.jpg

Close all open windows except HijackThis and then click the "Fix checked" button.
Please download hoster from the link below. If you have succeeded to download it before you do not need to do it again.

http://www.funkytoad.com/download/hoster.zip

Open Hoster.exe.

Then click on "Restore Original Hosts"

Close program when complete.
Do a HijackThis acan and post the log. Let me also know if there is a problem at any point of the fix.

Do not give up. E

jacqueee

Post #29August 11, 2005, 10:34 PM UTC

Here we go! I'm glad you're leading me through this because some of the notes (like…are you sure you want to do this) look pretty scary!! :-)
I had no problems doing exactly what you requested. The R1-HKCU\Software\Microsoft etc. was not there so I didn't have to fix it.
After I ran th spy killer,there was a note "A LOP uninstaller was already run from add/remove programs and the LOP software may be completely removed already, but you can click YES to force the uninstall of any LOP software or left over LOP files found on this computer" . I clicked YES. By the way, what is LOP?

Logfile of HijackThis v1.99.1
Scan saved at 6:22:04 PM, on 08/11/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Personal Firewall\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINDOWS\System32\devldr32.exe
C:\WINDOWS\DELLMMKB.EXE
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\PROGRA~1\ADELPH~1\SMARTB~1\MotiveSB.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Netropa\OSD.exe
C:\Program Files\RFA\rfagent.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
C:\PROGRA~1\NORTON~3\NORTON~2\NPROTECT.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\PROGRA~1\INCRED~1\bin\IMApp.exe
C:\Program Files\America Online 8.0\aoltray.exe
C:\PROGRA~1\NORTON~3\NORTON~2\SPEEDD~1\NOPDB.EXE
C:\Program Files\Corel\WordPerfect Office 2000\programs\alarm.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Corel\WordPerfect Office 2000\programs\dad9.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\unzipped\hijackthis[1]\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.msnbc.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.msnbc.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msnbc.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~2\tools\iesdsg.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe
O4 - HKLM\..\Run: [AHQInit] C:\Program Files\Creative\SBLive\Program\AHQInit.exe
O4 - HKLM\..\Run: [DellTouch] C:\WINDOWS\DELLMMKB.EXE
O4 - HKLM\..\Run: [POINTER] C:\Program Files\Microsoft Hardware\Mouse\point32.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\ADELPH~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [AudioHQ] C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [RFAgent] C:\Program Files\RFA\rfagent.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKCU\..\Run: [IncrediMail] C:\PROGRA~1\INCRED~1\bin\IncMail.exe /c
O4 - HKCU\..\Run: [Norton SystemWorks] "C:\Program Files\Norton SystemWorks\cfgwiz.exe" /GUID {05858CFD-5CC4-4ceb-AAAF-CF00BF39736A} /MODE CfgWiz
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_1
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Adelphia eSupport Assistant.lnk = C:\Program Files\Adelphia eSupport Assistant\bin\matcli.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: America Online Tray Icon.lnk = C:\Program Files\America Online 8.0\aoltray.exe
O4 - Global Startup: Camio Viewer 2000.lnk = C:\Program Files\Sierra Imaging\Image Expert 2000\IXApplet.exe
O4 - Global Startup: CorelCENTRAL Alarms.LNK = C:\Program Files\Corel\WordPerfect Office 2000\programs\alarm.exe
O4 - Global Startup: Desktop Application Director 9.LNK = C:\Program Files\Corel\WordPerfect Office 2000\programs\dad9.exe
O4 - Global Startup: Dr.Speed NetRx.lnk = C:\Program Files\Aluria Software\DrSpeed Suite\drspeed.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Si&milar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.msnbc.com
O14 - IERESET.INF: MS_START_PAGE_URL=http://www.msnbc.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid;=0x409
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200305…meInstaller.exe
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secur…loadManager.ocx
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.av.aol.com/molbin/shared/m…,18/mcgdmgr.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/asa/SymAData.cab
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IMDownloader Class) - http://www2.incredimail.com/contents/setup…er/imloader.cab
O18 - Protocol: SafeAuthenticate - {8125919B-9BE9-4213-A1D6-75188A22D21E} - C:\WINDOWS\MVNFILT3.DLL
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: IMAPI CD-Burning COM Service (ImapiService) - Roxio Inc. - C:\WINDOWS\System32\ImapiRox.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Personal Firewall\ISSVC.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
O23 - Service: Netropa NHK Server (Nhksrv) - Unknown owner - C:\WINDOWS\Nhksrv.exe (file missing)
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~3\NORTON~2\NPROTECT.EXE
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~3\NORTON~2\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

Thank you

Elrond

Post #30August 12, 2005, 12:34 AM UTC

Yipee jacqueee, your log looks clean at last.

This is IMPORTANT: You need to update your Windows. It is out of date. The version you should have at this time is Windows XP with SP2.

If you have a high-speed internet connection, go to”Start”> "Tools" menu > "Windows Update" or go to Microsoft Windows and Internet Explorer Updates to get the critical updates including SP2.

However if you have a dialup connection I would advise you to order the CD as the download is large and will take a VERY long time to download.
You can get the CD here .
Please inform me if you had any problems with the upgrade.

Let me have a new HijackThis log when you have done the update just to be sure.

Once that is done I will give you spome pointers about how to protect yourself against new infections.

E

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Another malware victim

✨ Ask AI

Ask AI