Spyware / Malware / Virus Removal

Please check my HijackThis Log

3 min read

Looking for the outcome? Ask AI

1excop36 Topic Starter

Post #1July 25, 2005, 9:25 PM UTC

Hello;

I finally joined the 21st Century and got DSL. I've had Norton Systemworks almost since my first computer years ago and just updated to the 2005 version. I've also been running Startup Mechanic plus Spybot S&D for almost 6 months now and just added AdAware SE, Spyware Blaster and CCleaner. My wife thinks I've gone overboard but after Norton and Spybot pickup on a couple trojans and spyware, I'm going withe the advice that I have at least 2 Spy/Adware programs. Thankfully, I've not notice any particuliar problem but I've been trying to fine tune my system and learn what I can before moving to my daughter's laptop which is an absolute mess (she relys on and trusts AOL to keep her system straight a concept of which I'm trying hard to disabuse her). Sorry for the long intro, here's my scan:

Logfile of HijackThis v1.99.1
Scan saved at 2:19:25 PM, on 7/25/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Stardock\SDMCP.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Free RAM Pro XP\FreeRAM XP Pro 1.40.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Second Nature\Snsicon.exe
C:\Program Files\BOINC\boincmgr.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
C:\PROGRA~1\NORTON~2\NORTON~2\NPROTECT.EXE
C:\Program Files\BOINC\boinc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\CursorXP\CursorXP.exe
C:\WINDOWS\System32\dllhost.exe
C:\PROGRA~1\MOZILL~2\FIREFOX.EXE
C:\Program Files\Hijack This\HijackThis.exe
C:\Program Files\Dillobits Software\4UOnly\4UOnly.exe
C:\PROGRA~1\MOZILL~1\THUNDE~1.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.myway.com/index.jsp?speedbarconfigchanged
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dellnet.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
R3 - Default URLSearchHook is missing
N4 - Mozilla: user_pref("browser.startup.homepage", "http://my.netscape.com/index2.psp"); (C:\Documents and Settings\Gerry Goldshine\Application Data\Mozilla\Profiles\default\8kil72nu.slt\prefs.js)
N4 - Mozilla: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%206%5Csearchplugins%5CSBWeb_02.src"); (C:\Documents and Settings\Gerry Goldshine\Application Data\Mozilla\Profiles\default\8kil72nu.slt\prefs.js)
O2 - BHO: Installer Class - {009506E8-8CAD-4CA9-81D4-D815E7E4330A} - (no file)
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_1.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {4B5F2E08-6F39-479a-B547-B2026E4C7EDF} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: IE_PopupBlocker Class - {656EC4B7-072B-4698-B504-2A414C1F0037} - C:\Program Files\Sonic.net Accelerator\prpl_IePopupBlocker.dll
O2 - BHO: (no name) - {944864A5-3916-46E2-96A9-A2E84F3F1208} - (no file)
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {CA356D79-679B-4b4c-8E49-5AF97014F4C1} - (no file)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: (no name) - {D49E9D35-254C-4c6a-9D17-95018D228FF5} - (no file)
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_1.dll
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [BootSkin Startup Jobs] "C:\Program Files\Stardock\WinCustomize\BootSkin\BootSkin.exe" /StartupJobs
O4 - HKCU\..\Run: [FreeRAM XP] "C:\Program Files\Free RAM Pro XP\FreeRAM XP Pro 1.40.exe" -win
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [CursorXP] C:\Program Files\CursorXP\CursorXP.exe
O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - Startup: BOINC Manager.lnk = C:\Program Files\BOINC\boincmgr.exe
O4 - Startup: EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\E_SRCV02.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Snsicon.lnk = C:\Program Files\Second Nature\Snsicon.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O14 - IERESET.INF: START_PAGE_URL=http://start.earthlink.net
O16 - DPF: DigiChat Applet - http://vdo-lax-002.cnshosting.net/DigiChat…_IE_5_0_1_7.cab
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15015/CTSUEng.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkId=39204&clcid;=0x409
O16 - DPF: {37DF41B2-61DB-4CAC-A755-CFB3C7EE7F40} - http://esupport.aol.com/help/acp2/engine/aolcoach_core_1.cab
O16 - DPF: {38578BF0-0ABB-11D3-9330-0080C6F796A1} (Create & Print ActiveX Plug-in) - http://di.imgag.com/imgag/cp/install/AxCtp.cab
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com/computercheckup/qdiagcc.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) -
O16 - DPF: {90A29DA5-D020-4B18-8660-6689520C7CD7} (DmiReader Class) - http://ftp.us.dell.com/fixes/PROFILER.CAB
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} -
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.av.aol.com/molbin/shared/m…,20/mcgdmgr.cab
O16 - DPF: {CAFEEFAC-0014-0000-0001-ABCDEFFEDCBA} (Java Runtime Environment 1.4.0_01) -
O16 - DPF: {CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA} -
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://playweb19.pogo.com/game/deluxe/insa…aploader_v6.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15014/CTPID.cab
O20 - Winlogon Notify: MCPClient - C:\Program Files\Common Files\Stardock\mcpstub.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~2\NPROTECT.EXE
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

Regards

Gerry

Siggyx

Post #2July 31, 2005, 3:35 AM UTC

Sorry for the delay please post a new hijackthis log.

1excop36

Post #3July 31, 2005, 4:29 AM UTC

Hello;

I'm sure there were people in more dire straits than me. Here is the latest log:

For what it's worth, I've yet to configure the LucidLink program as I also need my daughter's machine to match settings.

Regards;

Gerry

Logfile of HijackThis v1.99.1
Scan saved at 9:18:47 PM, on 7/30/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Stardock\SDMCP.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\Program Files\InterlinkNetworks\LucidLinkServer\Bin\LucidLinkServer.exe
C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\CursorXP\CursorXP.exe
C:\Program Files\Free RAM Pro XP\FreeRAM XP Pro 1.40.exe
C:\Program Files\Second Nature\Snsicon.exe
C:\Program Files\BOINC\boincmgr.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
C:\PROGRA~1\NORTON~2\NORTON~2\NPROTECT.EXE
C:\Program Files\BOINC\boinc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Hijack This\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.myway.com/index.jsp?speedbarconfigchanged
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dellnet.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
R3 - Default URLSearchHook is missing
N4 - Mozilla: user_pref("browser.startup.homepage", "http://my.myway.com/index.jsp"); (C:\Documents and Settings\Gerry Goldshine\Application Data\Mozilla\Profiles\default\8kil72nu.slt\prefs.js)
N4 - Mozilla: user_pref("browser.search.defaultengine", "http://www.google.com/firefox/"); (C:\Documents and Settings\Gerry Goldshine\Application Data\Mozilla\Profiles\default\8kil72nu.slt\prefs.js)
O2 - BHO: Installer Class - {009506E8-8CAD-4CA9-81D4-D815E7E4330A} - (no file)
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_1.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {4B5F2E08-6F39-479a-B547-B2026E4C7EDF} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: IE_PopupBlocker Class - {656EC4B7-072B-4698-B504-2A414C1F0037} - C:\Program Files\Sonic.net Accelerator\prpl_IePopupBlocker.dll
O2 - BHO: (no name) - {944864A5-3916-46E2-96A9-A2E84F3F1208} - (no file)
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {CA356D79-679B-4b4c-8E49-5AF97014F4C1} - (no file)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: (no name) - {D49E9D35-254C-4c6a-9D17-95018D228FF5} - (no file)
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_1.dll
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [BootSkin Startup Jobs] "C:\Program Files\Stardock\WinCustomize\BootSkin\BootSkin.exe" /StartupJobs
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [CursorXP] C:\Program Files\CursorXP\CursorXP.exe
O4 - HKCU\..\Run: [FreeRAM XP] "C:\Program Files\Free RAM Pro XP\FreeRAM XP Pro 1.40.exe" -win
O4 - Startup: BOINC Manager.lnk = C:\Program Files\BOINC\boincmgr.exe
O4 - Startup: EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\E_SRCV02.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Snsicon.lnk = C:\Program Files\Second Nature\Snsicon.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O12 - Plugin for .htm: C:\Program Files\Netscape\Netscape Browser\PLUGINS\npTrident.dll
O14 - IERESET.INF: START_PAGE_URL=http://start.earthlink.net
O16 - DPF: DigiChat Applet - http://vdo-lax-002.cnshosting.net/DigiChat…_IE_5_0_1_7.cab
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15015/CTSUEng.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkId=39204&clcid=0x409
O16 - DPF: {37DF41B2-61DB-4CAC-A755-CFB3C7EE7F40} - http://esupport.aol.com/help/acp2/engine/aolcoach_core_1.cab
O16 - DPF: {38578BF0-0ABB-11D3-9330-0080C6F796A1} (Create & Print ActiveX Plug-in) - http://di.imgag.com/imgag/cp/install/AxCtp.cab
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com/computercheckup/qdiagcc.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) -
O16 - DPF: {90A29DA5-D020-4B18-8660-6689520C7CD7} (DmiReader Class) - http://ftp.us.dell.com/fixes/PROFILER.CAB
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} -
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.av.aol.com/molbin/shared/m…,20/mcgdmgr.cab
O16 - DPF: {CAFEEFAC-0014-0000-0001-ABCDEFFEDCBA} (Java Runtime Environment 1.4.0_01) -
O16 - DPF: {CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA} -
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://playweb19.pogo.com/game/deluxe/insa…aploader_v6.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15014/CTPID.cab
O20 - Winlogon Notify: MCPClient - C:\Program Files\Common Files\Stardock\mcpstub.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O23 - Service: Interlink Networks LucidLink Server (ILNSoftPadlock) - Interlink Networks Inc. - C:\Program Files\InterlinkNetworks\LucidLinkServer\Bin\LucidLinkServer.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~2\NPROTECT.EXE
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

Siggyx

Post #4July 31, 2005, 2:03 PM UTC

Step # 1

Please download and run CWShredder. Make sure that all browser windows are closed with the exception of Cwshredder and choose FIX.

http://www.majorgeeks.com/downloadget.php?…7fd6b3ff02edc90

REBOOT

Step #2

Please download and run Spybot 1.4 & AdAware SE Then follow the instructions in the link below to run.

Spybot & Adaware Tutorial

REBOOT

Step # 3

Then do a virus scan here >>> Trend Micro

NEXT

Please download the trial version of Ewido Security Suite here:
http://www.ewido.net/en/download/

Install it, and update the definitions to the newest files.

Next, please reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Select the first option, to run Windows in Safe Mode.

Then please run Ewido, and run a full scan. Save the logfile from the scan.

Restart your computer in normal mode and please post a new HijackThis log, as well as the log from the Ewido scan.

1excop36

Post #5July 31, 2005, 10:53 PM UTC

Hello;

Well, finally finished all the scans. CWShredder revealed no problems. SpyBot uncovered 30 entries related to Wild Tangent which was linked to an AOL game my daughter installed. I made sure all traces of it were gone after SpyBot did its thing. AdAware showed nothing wrong. Trend Micro (which btw works only with IE and not Firefox) showed no virus present. Ewido showed 133 infections while running windows in the Safe Mode. Per your instruction, I have included the logfile from it.

One new problem that has cropped up and is getting worse is that it is taking longer and longer for network/DSL connect to load upon the start of Windows. In addition, just before it does load, either Norton or Windows shows an very brief alert from the sys tray that my system is unprotected. As soon as the Network icon pops up in the tray and the DSL connection is made, the alert goes away. This actually began after my brief flirtation with ZoneAlarm's firewall.

Here's the Ewido Logfile. What's interesting is that I no longer have Earthlink (having gone DSL with a local company) and thought I had uninstalled all of their software:

———————————————————
ewido security suite - Scan report
———————————————————

+ Created on: 3:22:19 PM, 7/31/2005
+ Report-Checksum: 534B35E2

+ Scan result:

C:\Documents and Settings\Gerry Goldshine\Application Data\Earthlink\6.0\[removed]\Cookies\gerry [removed][1].txt -> Spyware.Cookie.Masterstats : Cleaned with backup
:mozilla.30:C:\Documents and Settings\Gerry Goldshine\Application Data\Mozilla\Firefox\Profiles\yipu22d7.default\cookies.txt -> Spyware.Cookie.Burstnet : Cleaned with backup
:mozilla.91:C:\Documents and Settings\Gerry Goldshine\Application Data\Mozilla\Firefox\Profiles\yipu22d7.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.92:C:\Documents and Settings\Gerry Goldshine\Application Data\Mozilla\Firefox\Profiles\yipu22d7.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.93:C:\Documents and Settings\Gerry Goldshine\Application Data\Mozilla\Firefox\Profiles\yipu22d7.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.94:C:\Documents and Settings\Gerry Goldshine\Application Data\Mozilla\Firefox\Profiles\yipu22d7.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.20:C:\RECYCLER\NPROTECT\00002056.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.21:C:\RECYCLER\NPROTECT\00002056.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.22:C:\RECYCLER\NPROTECT\00002056.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.23:C:\RECYCLER\NPROTECT\00002056.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.25:C:\RECYCLER\NPROTECT\00002056.MOZ -> Spyware.Cookie.Burstnet : Cleaned with backup
:mozilla.26:C:\RECYCLER\NPROTECT\00002056.MOZ -> Spyware.Cookie.Burstnet : Cleaned with backup
:mozilla.20:C:\RECYCLER\NPROTECT\00002057.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.21:C:\RECYCLER\NPROTECT\00002057.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.22:C:\RECYCLER\NPROTECT\00002057.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.23:C:\RECYCLER\NPROTECT\00002057.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.25:C:\RECYCLER\NPROTECT\00002057.MOZ -> Spyware.Cookie.Burstnet : Cleaned with backup
:mozilla.26:C:\RECYCLER\NPROTECT\00002057.MOZ -> Spyware.Cookie.Burstnet : Cleaned with backup
:mozilla.24:C:\RECYCLER\NPROTECT\00002058.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.25:C:\RECYCLER\NPROTECT\00002058.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.26:C:\RECYCLER\NPROTECT\00002058.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.27:C:\RECYCLER\NPROTECT\00002058.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.29:C:\RECYCLER\NPROTECT\00002058.MOZ -> Spyware.Cookie.Burstnet : Cleaned with backup
:mozilla.30:C:\RECYCLER\NPROTECT\00002058.MOZ -> Spyware.Cookie.Burstnet : Cleaned with backup
:mozilla.29:C:\RECYCLER\NPROTECT\00002059.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.30:C:\RECYCLER\NPROTECT\00002059.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.31:C:\RECYCLER\NPROTECT\00002059.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.32:C:\RECYCLER\NPROTECT\00002059.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.34:C:\RECYCLER\NPROTECT\00002059.MOZ -> Spyware.Cookie.Burstnet : Cleaned with backup
:mozilla.35:C:\RECYCLER\NPROTECT\00002059.MOZ -> Spyware.Cookie.Burstnet : Cleaned with backup
:mozilla.29:C:\RECYCLER\NPROTECT\00002060.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.30:C:\RECYCLER\NPROTECT\00002060.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.31:C:\RECYCLER\NPROTECT\00002060.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.32:C:\RECYCLER\NPROTECT\00002060.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.34:C:\RECYCLER\NPROTECT\00002060.MOZ -> Spyware.Cookie.Burstnet : Cleaned with backup
:mozilla.35:C:\RECYCLER\NPROTECT\00002060.MOZ -> Spyware.Cookie.Burstnet : Cleaned with backup
:mozilla.32:C:\RECYCLER\NPROTECT\00002075.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.33:C:\RECYCLER\NPROTECT\00002075.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.34:C:\RECYCLER\NPROTECT\00002075.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.35:C:\RECYCLER\NPROTECT\00002075.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.37:C:\RECYCLER\NPROTECT\00002075.MOZ -> Spyware.Cookie.Burstnet : Cleaned with backup
:mozilla.38:C:\RECYCLER\NPROTECT\00002075.MOZ -> Spyware.Cookie.Burstnet : Cleaned with backup
:mozilla.35:C:\RECYCLER\NPROTECT\00002076.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.36:C:\RECYCLER\NPROTECT\00002076.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.37:C:\RECYCLER\NPROTECT\00002076.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.38:C:\RECYCLER\NPROTECT\00002076.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.40:C:\RECYCLER\NPROTECT\00002076.MOZ -> Spyware.Cookie.Burstnet : Cleaned with backup
:mozilla.41:C:\RECYCLER\NPROTECT\00002076.MOZ -> Spyware.Cookie.Burstnet : Cleaned with backup
:mozilla.36:C:\RECYCLER\NPROTECT\00002078.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.37:C:\RECYCLER\NPROTECT\00002078.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.38:C:\RECYCLER\NPROTECT\00002078.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.39:C:\RECYCLER\NPROTECT\00002078.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.41:C:\RECYCLER\NPROTECT\00002078.MOZ -> Spyware.Cookie.Burstnet : Cleaned with backup
:mozilla.42:C:\RECYCLER\NPROTECT\00002078.MOZ -> Spyware.Cookie.Burstnet : Cleaned with backup
:mozilla.36:C:\RECYCLER\NPROTECT\00002318.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.37:C:\RECYCLER\NPROTECT\00002318.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.38:C:\RECYCLER\NPROTECT\00002318.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.39:C:\RECYCLER\NPROTECT\00002318.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.41:C:\RECYCLER\NPROTECT\00002318.MOZ -> Spyware.Cookie.Burstnet : Cleaned with backup
:mozilla.42:C:\RECYCLER\NPROTECT\00002318.MOZ -> Spyware.Cookie.Burstnet : Cleaned with backup
:mozilla.36:C:\RECYCLER\NPROTECT\00002320.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.37:C:\RECYCLER\NPROTECT\00002320.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.38:C:\RECYCLER\NPROTECT\00002320.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.39:C:\RECYCLER\NPROTECT\00002320.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.41:C:\RECYCLER\NPROTECT\00002320.MOZ -> Spyware.Cookie.Burstnet : Cleaned with backup
:mozilla.42:C:\RECYCLER\NPROTECT\00002320.MOZ -> Spyware.Cookie.Burstnet : Cleaned with backup
:mozilla.35:C:\RECYCLER\NPROTECT\00002422.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.36:C:\RECYCLER\NPROTECT\00002422.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.37:C:\RECYCLER\NPROTECT\00002422.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.38:C:\RECYCLER\NPROTECT\00002422.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.40:C:\RECYCLER\NPROTECT\00002422.MOZ -> Spyware.Cookie.Burstnet : Cleaned with backup
:mozilla.41:C:\RECYCLER\NPROTECT\00002422.MOZ -> Spyware.Cookie.Burstnet : Cleaned with backup
:mozilla.36:C:\RECYCLER\NPROTECT\00002423.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.37:C:\RECYCLER\NPROTECT\00002423.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.38:C:\RECYCLER\NPROTECT\00002423.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.39:C:\RECYCLER\NPROTECT\00002423.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.41:C:\RECYCLER\NPROTECT\00002423.MOZ -> Spyware.Cookie.Burstnet : Cleaned with backup
:mozilla.42:C:\RECYCLER\NPROTECT\00002423.MOZ -> Spyware.Cookie.Burstnet : Cleaned with backup
:mozilla.41:C:\RECYCLER\NPROTECT\00002542.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.42:C:\RECYCLER\NPROTECT\00002542.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.43:C:\RECYCLER\NPROTECT\00002542.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.44:C:\RECYCLER\NPROTECT\00002542.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.46:C:\RECYCLER\NPROTECT\00002542.MOZ -> Spyware.Cookie.Burstnet : Cleaned with backup
:mozilla.47:C:\RECYCLER\NPROTECT\00002542.MOZ -> Spyware.Cookie.Burstnet : Cleaned with backup
:mozilla.40:C:\RECYCLER\NPROTECT\00002545.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.41:C:\RECYCLER\NPROTECT\00002545.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.42:C:\RECYCLER\NPROTECT\00002545.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.43:C:\RECYCLER\NPROTECT\00002545.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.45:C:\RECYCLER\NPROTECT\00002545.MOZ -> Spyware.Cookie.Burstnet : Cleaned with backup
:mozilla.46:C:\RECYCLER\NPROTECT\00002545.MOZ -> Spyware.Cookie.Burstnet : Cleaned with backup
C:\RECYCLER\NPROTECT\00117256.dll -> Spyware.WildTangent : Cleaned with backup
C:\RECYCLER\NPROTECT\00117492.dll -> Spyware.WildTangent : Cleaned with backup
:mozilla.9:C:\RECYCLER\NPROTECT\00118326.MOZ -> Spyware.Cookie.Burstnet : Cleaned with backup
:mozilla.83:C:\RECYCLER\NPROTECT\00118326.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.84:C:\RECYCLER\NPROTECT\00118326.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.85:C:\RECYCLER\NPROTECT\00118326.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.86:C:\RECYCLER\NPROTECT\00118326.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.13:C:\RECYCLER\NPROTECT\00118327.MOZ -> Spyware.Cookie.Burstnet : Cleaned with backup
:mozilla.87:C:\RECYCLER\NPROTECT\00118327.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.88:C:\RECYCLER\NPROTECT\00118327.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.89:C:\RECYCLER\NPROTECT\00118327.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.90:C:\RECYCLER\NPROTECT\00118327.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.15:C:\RECYCLER\NPROTECT\00118329.MOZ -> Spyware.Cookie.Burstnet : Cleaned with backup
:mozilla.89:C:\RECYCLER\NPROTECT\00118329.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.90:C:\RECYCLER\NPROTECT\00118329.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.91:C:\RECYCLER\NPROTECT\00118329.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.92:C:\RECYCLER\NPROTECT\00118329.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.15:C:\RECYCLER\NPROTECT\00118355.MOZ -> Spyware.Cookie.Burstnet : Cleaned with backup
:mozilla.89:C:\RECYCLER\NPROTECT\00118355.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.90:C:\RECYCLER\NPROTECT\00118355.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.91:C:\RECYCLER\NPROTECT\00118355.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.92:C:\RECYCLER\NPROTECT\00118355.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.29:C:\RECYCLER\NPROTECT\00118356.MOZ -> Spyware.Cookie.Burstnet : Cleaned with backup
:mozilla.90:C:\RECYCLER\NPROTECT\00118356.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.91:C:\RECYCLER\NPROTECT\00118356.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.92:C:\RECYCLER\NPROTECT\00118356.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.93:C:\RECYCLER\NPROTECT\00118356.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.29:C:\RECYCLER\NPROTECT\00118404.MOZ -> Spyware.Cookie.Burstnet : Cleaned with backup
:mozilla.90:C:\RECYCLER\NPROTECT\00118404.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.91:C:\RECYCLER\NPROTECT\00118404.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.92:C:\RECYCLER\NPROTECT\00118404.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.93:C:\RECYCLER\NPROTECT\00118404.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.29:C:\RECYCLER\NPROTECT\00118405.MOZ -> Spyware.Cookie.Burstnet : Cleaned with backup
:mozilla.90:C:\RECYCLER\NPROTECT\00118405.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.91:C:\RECYCLER\NPROTECT\00118405.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.92:C:\RECYCLER\NPROTECT\00118405.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.93:C:\RECYCLER\NPROTECT\00118405.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.29:C:\RECYCLER\NPROTECT\00118406.MOZ -> Spyware.Cookie.Burstnet : Cleaned with backup
:mozilla.90:C:\RECYCLER\NPROTECT\00118406.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.91:C:\RECYCLER\NPROTECT\00118406.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.92:C:\RECYCLER\NPROTECT\00118406.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.93:C:\RECYCLER\NPROTECT\00118406.MOZ -> Spyware.Cookie.Yieldmanager : Cleaned with backup
C:\WINDOWS\Downloaded Program Files\popcaploader.dll -> Not-A-Virus.PornWare.PopCap.b : Cleaned with backup

::Report End

Here's the new Hijack This Logfile:

Logfile of HijackThis v1.99.1
Scan saved at 3:26:43 PM, on 7/31/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Stardock\SDMCP.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\CursorXP\CursorXP.exe
C:\Program Files\Free RAM Pro XP\FreeRAM XP Pro 1.40.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\Second Nature\Snsicon.exe
C:\Program Files\BOINC\boincmgr.exe
C:\Program Files\InterlinkNetworks\LucidLinkServer\Bin\LucidLinkServer.exe
C:\Program Files\BOINC\boinc.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
C:\PROGRA~1\NORTON~2\NORTON~2\NPROTECT.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Hijack This\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.myway.com/index.jsp?speedbarconfigchanged
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dellnet.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
R3 - Default URLSearchHook is missing
N4 - Mozilla: user_pref("browser.startup.homepage", "http://my.myway.com/index.jsp"); (C:\Documents and Settings\Gerry Goldshine\Application Data\Mozilla\Profiles\default\8kil72nu.slt\prefs.js)
N4 - Mozilla: user_pref("browser.search.defaultengine", "http://www.google.com/firefox/"); (C:\Documents and Settings\Gerry Goldshine\Application Data\Mozilla\Profiles\default\8kil72nu.slt\prefs.js)
O2 - BHO: Installer Class - {009506E8-8CAD-4CA9-81D4-D815E7E4330A} - (no file)
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_1.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {4B5F2E08-6F39-479a-B547-B2026E4C7EDF} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: IE_PopupBlocker Class - {656EC4B7-072B-4698-B504-2A414C1F0037} - C:\Program Files\Sonic.net Accelerator\prpl_IePopupBlocker.dll
O2 - BHO: (no name) - {944864A5-3916-46E2-96A9-A2E84F3F1208} - (no file)
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {CA356D79-679B-4b4c-8E49-5AF97014F4C1} - (no file)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: (no name) - {D49E9D35-254C-4c6a-9D17-95018D228FF5} - (no file)
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_1.dll
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [BootSkin Startup Jobs] "C:\Program Files\Stardock\WinCustomize\BootSkin\BootSkin.exe" /StartupJobs
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [CursorXP] C:\Program Files\CursorXP\CursorXP.exe
O4 - HKCU\..\Run: [FreeRAM XP] "C:\Program Files\Free RAM Pro XP\FreeRAM XP Pro 1.40.exe" -win
O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - Startup: BOINC Manager.lnk = C:\Program Files\BOINC\boincmgr.exe
O4 - Startup: EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\E_SRCV02.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Snsicon.lnk = C:\Program Files\Second Nature\Snsicon.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O12 - Plugin for .htm: C:\Program Files\Netscape\Netscape Browser\PLUGINS\npTrident.dll
O14 - IERESET.INF: START_PAGE_URL=http://start.earthlink.net
O16 - DPF: DigiChat Applet - http://vdo-lax-002.cnshosting.net/DigiChat…_IE_5_0_1_7.cab
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15015/CTSUEng.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage) - http://go.microsoft.com/fwlink/?LinkId=39204&clcid=0x409
O16 - DPF: {37DF41B2-61DB-4CAC-A755-CFB3C7EE7F40} - http://esupport.aol.com/help/acp2/engine/aolcoach_core_1.cab
O16 - DPF: {38578BF0-0ABB-11D3-9330-0080C6F796A1} (Create & Print ActiveX Plug-in) - http://di.imgag.com/imgag/cp/install/AxCtp.cab
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com/computercheckup/qdiagcc.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) -
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {90A29DA5-D020-4B18-8660-6689520C7CD7} (DmiReader Class) - http://ftp.us.dell.com/fixes/PROFILER.CAB
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} -
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.av.aol.com/molbin/shared/m…,20/mcgdmgr.cab
O16 - DPF: {CAFEEFAC-0014-0000-0001-ABCDEFFEDCBA} (Java Runtime Environment 1.4.0_01) -
O16 - DPF: {CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA} -
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://playweb19.pogo.com/game/deluxe/insa…aploader_v6.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15014/CTPID.cab
O20 - Winlogon Notify: MCPClient - C:\Program Files\Common Files\Stardock\mcpstub.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: Interlink Networks LucidLink Server (ILNSoftPadlock) - Interlink Networks Inc. - C:\Program Files\InterlinkNetworks\LucidLinkServer\Bin\LucidLinkServer.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~2\NPROTECT.EXE
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

Siggyx

Post #6August 1, 2005, 2:58 PM UTC

Please disable Teatimer, tutorial here >>>> http://russelltexas.com/malware/teatimer.htm

Scan with hijackthis and put a check beside these lines and choose FIX

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer

R3 - Default URLSearchHook is missing

O2 - BHO: Installer Class - {009506E8-8CAD-4CA9-81D4-D815E7E4330A} - (no file)
O2 - BHO: (no name) - {4B5F2E08-6F39-479a-B547-B2026E4C7EDF} - (no file)
O2 - BHO: (no name) - {944864A5-3916-46E2-96A9-A2E84F3F1208} - (no file)
O2 - BHO: (no name) - {CA356D79-679B-4b4c-8E49-5AF97014F4C1} - (no file)

O3 - Toolbar: (no name) - {D49E9D35-254C-4c6a-9D17-95018D228FF5} - (no file)

O16 - DPF: DigiChat Applet - http://vdo-lax-002.cnshosting.net/DigiChat…_IE_5_0_1_7.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage) - http://go.microsoft.com/fwlink/?LinkId=39204&clcid=0x409
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} -
O16 - DPF: {CAFEEFAC-0014-0000-0001-ABCDEFFEDCBA} (Java Runtime Environment 1.4.0_01) -
O16 - DPF: {CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA} -

Then reboot and post a new log please.

1excop36

Post #7August 1, 2005, 7:51 PM UTC last edited August 1, 2005, 7:52 PM UTC

Hello Siggyx;

Okay, disabled the tea-timer from SpyBot as directed. Rebooted. Ran the HijackThis scan and fix those items you indicated. Rebooted. Ran HijackThis again and they're gone.

However; you didn't say whether or not to enable the tea-timer on SpyBot. I did so and rebooted and then ran another HijackThis scan….with the exception of the R1, R3 and O3 items you had me check for removal, everything else was back. I did save a copy of the scan log of what happened, should you want to look at it.

I disabled tea-timer again, rebooted, ran HijackThis, again checked off the remaining items to advised for removal and ran "Fix". Rebooted and as the log below shows, they are gone. I have not enabled tea-timer or SpyBot at this time.

While you're the expert and I will humbely follow your instructions to the letter, I was wondering if running a new SpyBot scan before enabling the tea-timer once more would take care of this or is this more involved.

Also, the Network/DSL connection is still the very last thing to load upon start-up and is also very slow to load when it does.

I very much appreciate your assistance on this.

Gerry

Here is the HijackThis Log:

Logfile of HijackThis v1.99.1
Scan saved at 12:27:50 PM, on 8/1/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Stardock\SDMCP.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\CursorXP\CursorXP.exe
C:\Program Files\Free RAM Pro XP\FreeRAM XP Pro 1.40.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Second Nature\Snsicon.exe
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\InterlinkNetworks\LucidLinkServer\Bin\LucidLinkServer.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
C:\PROGRA~1\NORTON~2\NORTON~2\NPROTECT.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Hijack This\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.myway.com/index.jsp?speedbarconfigchanged
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dellnet.com/
N4 - Mozilla: user_pref("browser.startup.homepage", "http://my.myway.com/index.jsp"); (C:\Documents and Settings\Gerry Goldshine\Application Data\Mozilla\Profiles\default\8kil72nu.slt\prefs.js)
N4 - Mozilla: user_pref("browser.search.defaultengine", "http://www.google.com/firefox/"); (C:\Documents and Settings\Gerry Goldshine\Application Data\Mozilla\Profiles\default\8kil72nu.slt\prefs.js)
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_1.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: IE_PopupBlocker Class - {656EC4B7-072B-4698-B504-2A414C1F0037} - C:\Program Files\Sonic.net Accelerator\prpl_IePopupBlocker.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_1.dll
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [BootSkin Startup Jobs] "C:\Program Files\Stardock\WinCustomize\BootSkin\BootSkin.exe" /StartupJobs
O4 - HKCU\..\Run: [CursorXP] C:\Program Files\CursorXP\CursorXP.exe
O4 - HKCU\..\Run: [FreeRAM XP] "C:\Program Files\Free RAM Pro XP\FreeRAM XP Pro 1.40.exe" -win
O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - Startup: EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\E_SRCV02.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Snsicon.lnk = C:\Program Files\Second Nature\Snsicon.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O12 - Plugin for .htm: C:\Program Files\Netscape\Netscape Browser\PLUGINS\npTrident.dll
O14 - IERESET.INF: START_PAGE_URL=http://start.earthlink.net
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15015/CTSUEng.cab
O16 - DPF: {37DF41B2-61DB-4CAC-A755-CFB3C7EE7F40} - http://esupport.aol.com/help/acp2/engine/aolcoach_core_1.cab
O16 - DPF: {38578BF0-0ABB-11D3-9330-0080C6F796A1} (Create & Print ActiveX Plug-in) - http://di.imgag.com/imgag/cp/install/AxCtp.cab
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com/computercheckup/qdiagcc.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) -
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {90A29DA5-D020-4B18-8660-6689520C7CD7} (DmiReader Class) - http://ftp.us.dell.com/fixes/PROFILER.CAB
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.av.aol.com/molbin/shared/m…,20/mcgdmgr.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://playweb19.pogo.com/game/deluxe/insa…aploader_v6.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15014/CTPID.cab
O20 - Winlogon Notify: MCPClient - C:\Program Files\Common Files\Stardock\mcpstub.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: Interlink Networks LucidLink Server (ILNSoftPadlock) - Interlink Networks Inc. - C:\Program Files\InterlinkNetworks\LucidLinkServer\Bin\LucidLinkServer.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~2\NPROTECT.EXE
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

Siggyx

Post #8August 1, 2005, 11:58 PM UTC

When you stary up Teatimer it usually asks if you want to allow the changes if so allow them. Your log looks clean at this point. Run ewido again in safe mode and post the log it produces please.

1excop36

Post #9August 2, 2005, 4:34 AM UTC

Regarding the teatimer, it didn't ask anything about allowing changes so I'm a little concerned about enabling it again if it's just going to replace those items. Any way around this issue? Also, I'm guessing since everything looks clean, that the startup issue of the network/dsl connection needs to be addressed elsewhere. Somewhere, in the dim recesses of my mind, I vaguely recall something about being able to change the startup order somehow but that may not be for this version of Windows. Anyway, when we're done with this, I gather I can uninstall ewido as it is only a 14 day trial? Btw, just curious if anything that you did find in my files of serious consequence? Again, thanks for the help. Here's the log you wanted: ——————————————————— ewido security suite - Scan report ——————————————————— + Created on: 9:13:52 PM, 8/1/2005 + Report-Checksum: A539FA8F + Scan result: C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP1296\A0131465.dll -> Spyware.WildTangent : Cleaned with backup C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP1296\A0131466.dll -> Spyware.WildTangent : Cleaned with backup ::Report End

Siggyx

Post #10August 2, 2005, 6:30 PM UTC

Overall you only had minor issues, one porn dialler was the most serious. You can also download the free version of Ewido.

1excop36

Post #11August 2, 2005, 7:15 PM UTC

Thanks for all your help. I managed to resolve the teatimer issue. Now if I can just get my daughter to let me do her computer which is a disaster in the making. Gerry

Siggyx

Post #12August 2, 2005, 7:45 PM UTC

Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Please check my HijackThis Log

✨ Ask AI

Ask AI