3 known problems

I have three known problems on this computer. W32/Alemod.e.dll, New Malware.q and StartPage-DU.dll. Any help will be greatly appreciated. Thank you.

Logfile of HijackThis v1.99.1
Scan saved at 3:34:17 PM, on 8/25/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\netgo32.exe
C:\WINDOWS\System32\atievxx.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\vyxctoli.exe
C:\Program Files\McAfee.com\VSO\mcvsshld.exe
C:\Program Files\McAfee.com\VSO\oasclnt.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Freenet\freenet.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\nettv32.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\HJT\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\gwbua.dll/sp.html#12047
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\gwbua.dll/sp.html#12047
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\gwbua.dll/sp.html#12047
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\gwbua.dll/sp.html#12047
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\gwbua.dll/sp.html#12047
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\gwbua.dll/sp.html#12047
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\gwbua.dll/sp.html#12047
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\System32\srvshics.exe,C:\Documents and Settings\Kevin\Application Data\Explorer\srvshics.exe
O2 - BHO: Class - {2DC1CC8E-DA42-4D83-4911-CAF35207C15A} - C:\WINDOWS\ipcr32.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [addvz.exe] C:\WINDOWS\addvz.exe
O4 - HKLM\..\Run: [msjl.exe] C:\WINDOWS\system32\msjl.exe
O4 - HKLM\..\Run: [vyxctoli] C:\WINDOWS\System32\vyxctoli.exe
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] C:\Program Files\McAfee.com\VSO\mcvsshld.exe
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [nettv32.exe] C:\WINDOWS\nettv32.exe
O4 - HKLM\..\RunServices: [desktop] C:\WINDOWS\System32\desktop.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [vyxctoli] C:\WINDOWS\System32\vyxctoli.exe
O4 - Startup: Freenet.lnk = C:\Program Files\Freenet\freenet.exe
O4 - Global Startup: WorldAntiSpy.lnk = C:\Program Files\WorldAntiSpy\WorldAntiSpy.exe
O16 - DPF: {11311111-1111-1111-1111-111111111157} - file://C:\Recycled\Q330995.exe
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m…96/mcinsctl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1125000980914
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1125000973423
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/m…,26/mcgdmgr.cab
O20 - Winlogon Notify: reset5 - C:\WINDOWS\SYSTEM32\reset5.dll
O21 - SSODL: Meeting WebControl - {6332E485-FED7-45AC-890F-98EAE72A6772} - (no file)
O23 - Service: Remote Procedure Call (RPC) Helper ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\netgo32.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: Reset 5 - Unknown owner - C:\WINDOWS\system32\srvany.exe (file missing)

Hello starphyre77, welcome to the tC.

Step#1:Getting Ready

(the reason Wordpad was chosen is that Notepad is sometimes deleted by this variant)


Please save these instructions to WordPad so that you have them accessible while following the steps. You also may want to print out these directions as the Internet will not be available.

After downloading the tools, you must disconnect from the internet totally, because staying connected while fixing will prevent the fix from working. Also please keep Internet Explorer and Outlook Express closed throughout as opening either will reinstall the infection.

To replace Internet Explorer to use during this fix, please use Internet Explorer once to download and install FireFox, to be used as your alternate browser throughout this fix.

Close Outlook Express and Internet Explorer for the duration of this fix


Please start by downloading the tools you will need to clean this infection. If you have a problem or question with any please continue to follow the list step by step to the end and ask the questions when you are asked to reply. Just be sure to let us know what the problem was when you finally reply.





Step#2:Show All Hidden Files

Please download and open the following zip file. Double-click on the file inside the zip and when it asks you if you would like to merge the file into your registry, please answer yes. This will make sure all files are visible on your computer.
http://www.davehigham.zen.co.uk/downloads/xphidden.zip




Step#3:Download CWShredder

1. Please Download the most recent version of CWShredder, from CWSInstall.exe

2. Check for Updates but please Do NOT use it yet


Step#4:Download About Buster


1. Please download About:Buster from here: http://www.malwarebytes.biz/AboutBuster5.zip.

2. Once it is downloaded extract it to c:\aboutbuster.

3. Check to make sure it is up-to-date. Please Do NOT use it yet


Step#5:Download HSfix.zip and Registrar Lite

1 . Download HSfix.zip and unzip it to your desktop:

http://users.telenet.be/marcvn/regfiles/HSfix.zip

It will probably create a folder for itself (it does on my XP system)

Please Do NOT use it yet


2. Another program to download is Registrar Lite for use later: Please download Registrar Lite and install it to C:\Program Files\RegLite\ . This is a registry editor that is very easy to use.


Please disconnect from the Internet




Step#6:Disable The Bad Service

• Reboot your computer into Safe Mode by tapping F8 while booting up and continue for the rest of the fix in SAFE MODE
  
• Click on start > control panel > administrative programs > services. Look for a service called Remote Procedure Call . Double click on that service and click stop and then set the startup to disabled. Also write down the name and path of the file listed in the Path to executable field. This filename must be deleted below.

Step#7:Stop The Running Processes

(only for Win2k/XP)


Press control-alt-delete to get into the task manager and end the following processes if they exist:

C:\WINNT\system32\ntrs.exe
C:\WINNT\system32\ietb32.exe



Step#8:Use HijackThis to Delete About BlankOpen HJT and select Misc Tools, select delete a File on Reboot.

I now need you to delete the following files:

C:\WINNT\system32\ntrs.exe
C:\WINNT\system32\ietb32.exe
C:\WINNT\system32\appvf32.dll


If you get an error when deleting a file. Right click on the file and check to see if the read only attribute is checked. if it is uncheck it and try again.



Step#9:Cleaning With HijackThis

Then close all programs and windows and run hijackthis. Put a checkmark next to each of these entries and click 'fix checked' button when ready (some may be gone after uninstalling some programs):


R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\gwbua.dll/sp.html#12047

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\gwbua.dll/sp.html#12047

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\gwbua.dll/sp.html#12047

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\gwbua.dll/sp.html#12047

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\gwbua.dll/sp.html#12047

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\gwbua.dll/sp.html#12047

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\gwbua.dll/sp.html#12047

R3 - Default URLSearchHook is missing

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\System32\srvshics.exe,C:\Documents and Settings\Kevin\Application Data\Explorer\srvshics.exe

O2 - BHO: Class - {2DC1CC8E-DA42-4D83-4911-CAF35207C15A} - C:\WINDOWS\ipcr32.dll

O4 - HKLM\..\Run: [addvz.exe] C:\WINDOWS\addvz.exe
O4 - HKLM\..\Run: [msjl.exe] C:\WINDOWS\system32\msjl.exe
O4 - HKLM\..\Run: [vyxctoli] C:\WINDOWS\System32\vyxctoli.exe
O4 - HKLM\..\Run: [nettv32.exe] C:\WINDOWS\nettv32.exe
O4 - HKLM\..\RunServices: [desktop] C:\WINDOWS\System32\desktop.exe
O4 - HKCU\..\Run: [vyxctoli] C:\WINDOWS\System32\vyxctoli.exe

O16 - DPF: {11311111-1111-1111-1111-111111111157} - file://C:\Recycled\Q330995.exe

O21 - SSODL: Meeting WebControl - {6332E485-FED7-45AC-890F-98EAE72A6772} - (no file)

O23 - Service: Remote Procedure Call (RPC) Helper ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\netgo32.exe

click "fix checked"

Delete these files:
srvshics.exe
C:\WINDOWS\addvz.exe
C:\WINDOWS\system32\msjl.exe
C:\WINDOWS\System32\vyxctoli.exe
C:\WINDOWS\nettv32.exe
C:\WINDOWS\System32\desktop.exe
C:\Recycled\Q330995.exe
C:\WINDOWS\netgo32.exe



Step#10: Backup The Registry

In the next step we are going to remove a service that gets installed by this malware.

1. Open Registrar Lite and run it.

2. Copy and paste the bold text below into the address bar of Registrar Lite:(this is making a Registry backup for safety in case of error)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\

Go to File> Export and and save as (in the C:\Program Files\Registrar Lite (Reglite) folder):

1.) Winkey.reg (Save as type: regedit4 .reg type)
2.) Winkey.hiv (Save as type: Scroll to select-regetd32/WinAPI *hiv *dat files)



Step#11: Delete the Registry Entries


Then double-click on the HSfix.reg file, and when it prompts to merge say yes, and this will clear some registry entries left behind by the process.

You should get a message reporting that the changes were successfully merged.


Step#12:Fixing With CWShredder

• CLOSE ALL WINDOWS except CWShredder
  
• Run the program by clicking 'fix' and letting it fix all CWS remnants.

Step#13:Fixing With About Buster

This is the step where we will use About:Buster that you had downloaded previously.

• Navigate to the c:\aboutbuster directory
• double-click on aboutbuster.exe
• When the tool opens press the OK button, then Start button, then the OK button
• then finally the Yes button. It will start scanning your computer for files.
• If it asks if you would like to do a second pass, allow it to do so.
• Post the log file in your next reply

Step#14:Reboot Sytem normally


Reboot your computer back to normal mode


Step#15:Scan and Post a New HJT log with other logs[
[*]Scan again with HijackThis. We still have a few steps to complete but a log file at this time would be helpful.


Reconnect To The Internet


[*]Post both your log from About Buster and your HijackThis log here in this thread with any questions or problems that you have run into. There are still some steps that are necessary to clear out all of the malware. There will be necessary files that it has deleted that will need to be replaced.

I followed your instructions to the best of my ability, but there were several things I couldn't find. I didn't get an About:Buster log; or if I did, I can't find it.
Here's my HJT log:

Logfile of HijackThis v1.99.1
Scan saved at 5:28:12 PM, on 9/2/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\atievxx.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
c:\PROGRA~1\mcafee.com\vso\OasClnt.exe
C:\WINDOWS\Explorer.EXE
c:\program files\mcafee.com\vso\mcvsshld.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
c:\program files\mcafee.com\agent\mcagent.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Freenet\freenet.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\HJT\hijackthis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
O2 - BHO: Class - {EB8F5697-D04E-7651-EDC8-030B538C42C1} - C:\WINDOWS\apixd32.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] C:\Program Files\McAfee.com\VSO\mcvsshld.exe
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [applh.exe] C:\WINDOWS\system32\applh.exe
O4 - HKLM\..\Run: [d3tx32.exe] C:\WINDOWS\system32\d3tx32.exe
O4 - HKLM\..\Run: [winid.exe] C:\WINDOWS\winid.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: Freenet.lnk = C:\Program Files\Freenet\freenet.exe
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m…96/mcinsctl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1125000980914
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1125000973423
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/m…,26/mcgdmgr.cab
O20 - Winlogon Notify: reset5 - C:\WINDOWS\SYSTEM32\reset5.dll
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: Reset 5 - Unknown owner - C:\WINDOWS\system32\srvany.exe (file missing)

Thank you

Here is my new log:

Logfile of HijackThis v1.99.1
Scan saved at 9:07:17 PM, on 9/2/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\atievxx.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\McAfee.com\VSO\mcvsshld.exe
C:\Program Files\McAfee.com\VSO\oasclnt.exe
c:\program files\mcafee.com\agent\mcagent.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Freenet\freenet.exe
C:\WINDOWS\System32\wuauclt.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\SoftwareDistribution\Download\S-1-5-18\7a57263d52ef89a3cee46b33df8a0a10\update\update.exe
c:\program files\mcafee.com\agent\mcupdate.exe
C:\Program Files\HJT\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\ffjir.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\ffjir.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\ffjir.dll/sp.html#37049
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\ffjir.dll/sp.html#37049
R3 - Default URLSearchHook is missing
O2 - BHO: Class - {EB8F5697-D04E-7651-EDC8-030B538C42C1} - C:\WINDOWS\apixd32.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] C:\Program Files\McAfee.com\VSO\mcvsshld.exe
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [iesd32.exe] C:\WINDOWS\system32\iesd32.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: Freenet.lnk = C:\Program Files\Freenet\freenet.exe
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m…96/mcinsctl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1125000980914
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1125000973423
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/m…,26/mcgdmgr.cab
O20 - Winlogon Notify: reset5 - C:\WINDOWS\SYSTEM32\reset5.dll
O23 - Service: Network Security Service ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\addkn.exe (file missing)
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: Reset 5 - Unknown owner - C:\WINDOWS\system32\srvany.exe (file missing)


As for how my computer behaves, I'm not entirely sure how to answer that so I'll just wing it. When going through startup I get an error message that says:

"Couldn't start the node, make sure FLaunch.ini has an entry javaw= pointing to javaw.exe or an entry Javaexec= pointing to a Java Runtime binary (java.exe)"

Also; McAfee still tells me it has deleted a StartPage-DU.dll and my Internet Exolorer home page is hijacked again.

Is that the kind of info you were looking for?
Thanks for your help, I really appreciate it.

Logfile of HijackThis v1.99.1
Scan saved at 2:44:56 PM, on 9/3/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\atievxx.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\McAfee.com\VSO\mcvsshld.exe
C:\Program Files\McAfee.com\VSO\oasclnt.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Freenet\freenet.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\HJT\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R3 - Default URLSearchHook is missing
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] C:\Program Files\McAfee.com\VSO\mcvsshld.exe
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: Freenet.lnk = C:\Program Files\Freenet\freenet.exe
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m…96/mcinsctl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1125000980914
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1125000973423
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/m…,26/mcgdmgr.cab
O20 - Winlogon Notify: reset5 - C:\WINDOWS\SYSTEM32\reset5.dll
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: Reset 5 - Unknown owner - C:\WINDOWS\system32\srvany.exe (file missing)


My computer didn't reboot after running SpSeHjfix.

(9/3/05 2:05:36 PM) SPSeHjFix started v1.1.2
(9/3/05 2:05:36 PM) OS: WinXP Service Pack 1 (5.1.2600)
(9/3/05 2:05:36 PM) Language: english
(9/3/05 2:05:36 PM) Win-Path: C:\WINDOWS
(9/3/05 2:05:36 PM) System-Path: C:\WINDOWS\System32
(9/3/05 2:05:36 PM) Temp-Path: C:\DOCUME~1\Kevin\LOCALS~1\Temp\
(9/3/05 2:05:38 PM) Disinfection started
(9/3/05 2:05:38 PM) Bad-Dll(IEP): c:\windows\system32\ffjir.dll
(9/3/05 2:05:38 PM) UBF: 4 - UBB: 0 - UBR: 8
(9/3/05 2:05:38 PM) UBF: 4 - UBB: 0 - UBR: 8
(9/3/05 2:05:38 PM) Bad IE-pages:
deleted: HKCU\Software\Microsoft\Internet Explorer\Main, Search Bar: res://c:\windows\system32\ffjir.dll/sp.html#37049
deleted: HKCU\Software\Microsoft\Internet Explorer\Main, Search Page: res://c:\windows\system32\ffjir.dll/sp.html#37049
deleted: HKCU\Software\Microsoft\Internet Explorer\Main, Start Page: about:blank
deleted: HKCU\Software\Microsoft\Internet Explorer\Search, SearchAssistant: res://c:\windows\system32\ffjir.dll/sp.html#37049
deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Search Bar: res://c:\windows\system32\ffjir.dll/sp.html#37049
deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Search Page: res://c:\windows\system32\ffjir.dll/sp.html#37049
deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Start Page: about:blank
deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Default_Page_URL: about:blank
deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Default_Search_URL: res://c:\windows\system32\ffjir.dll/sp.html#37049
deleted: HKLM\Software\Microsoft\Internet Explorer\Search, SearchAssistant: res://c:\windows\system32\ffjir.dll/sp.html#37049
(9/3/05 2:05:38 PM) Stealth-String not found
(9/3/05 2:05:38 PM) No locked Files to delete. End without Reboot
(9/3/05 2:05:47 PM) Disinfection started
(9/3/05 2:05:47 PM) Bad-Dll(IEP): c:\windows\system32\ffjir.dll
(9/3/05 2:05:47 PM) UBF: 4 - UBB: 0 - UBR: 8
(9/3/05 2:05:47 PM) UBF: 4 - UBB: 0 - UBR: 8
(9/3/05 2:05:47 PM) Bad IE-pages: (none)
(9/3/05 2:05:47 PM) Stealth-String not found
(9/3/05 2:05:47 PM) No locked Files to delete. End without Reboot
(9/3/05 2:06:58 PM) Disinfection started
(9/3/05 2:06:58 PM) Bad-Dll(IEP): c:\windows\system32\ffjir.dll
(9/3/05 2:06:58 PM) UBF: 4 - UBB: 0 - UBR: 8
(9/3/05 2:06:58 PM) UBF: 4 - UBB: 0 - UBR: 8
(9/3/05 2:06:58 PM) Bad IE-pages: (none)
(9/3/05 2:06:58 PM) Stealth-String not found
(9/3/05 2:06:58 PM) No locked Files to delete. End without Reboot


(9/3/05 2:07:14 PM) SPSeHjFix started v1.1.2
(9/3/05 2:07:14 PM) OS: WinXP Service Pack 1 (5.1.2600)
(9/3/05 2:07:14 PM) Language: english
(9/3/05 2:07:14 PM) Win-Path: C:\WINDOWS
(9/3/05 2:07:14 PM) System-Path: C:\WINDOWS\System32
(9/3/05 2:07:14 PM) Temp-Path: C:\DOCUME~1\Kevin\LOCALS~1\Temp\
(9/3/05 2:07:16 PM) Disinfection started
(9/3/05 2:07:16 PM) Bad-Dll(IEP): (not found)
(9/3/05 2:07:16 PM) Bad-Dll(IEP) in BHO: (not found)
(9/3/05 2:07:16 PM) UBF: 4 - UBB: 0 - UBR: 8
(9/3/05 2:07:16 PM) UBF: 4 - UBB: 0 - UBR: 8
(9/3/05 2:07:16 PM) Bad IE-pages: (none)
(9/3/05 2:07:16 PM) Stealth-String not found
(9/3/05 2:07:16 PM) Not infected->END


(9/3/05 2:12:58 PM) SPSeHjFix started v1.1.2
(9/3/05 2:12:58 PM) OS: WinXP Service Pack 1 (5.1.2600)
(9/3/05 2:12:58 PM) Language: english
(9/3/05 2:12:58 PM) Win-Path: C:\WINDOWS
(9/3/05 2:12:58 PM) System-Path: C:\WINDOWS\System32
(9/3/05 2:12:58 PM) Temp-Path: C:\DOCUME~1\Kevin\LOCALS~1\Temp\
(9/3/05 2:13:02 PM) Disinfection started
(9/3/05 2:13:02 PM) Bad-Dll(IEP): (not found)
(9/3/05 2:13:02 PM) Bad-Dll(IEP) in BHO: (not found)
(9/3/05 2:13:02 PM) UBF: 4 - UBB: 0 - UBR: 8
(9/3/05 2:13:02 PM) UBF: 4 - UBB: 0 - UBR: 8
(9/3/05 2:13:02 PM) Bad IE-pages: (none)
(9/3/05 2:13:02 PM) Stealth-String not found
(9/3/05 2:13:02 PM) Not infected->END


(9/3/05 2:29:46 PM) SPSeHjFix started v1.1.2
(9/3/05 2:29:46 PM) OS: WinXP Service Pack 1 (5.1.2600)
(9/3/05 2:29:46 PM) Language: english
(9/3/05 2:29:46 PM) Win-Path: C:\WINDOWS
(9/3/05 2:29:46 PM) System-Path: C:\WINDOWS\System32
(9/3/05 2:29:46 PM) Temp-Path: C:\DOCUME~1\Kevin\LOCALS~1\Temp\
(9/3/05 2:29:51 PM) Disinfection started
(9/3/05 2:29:51 PM) Bad-Dll(IEP): (not found)
(9/3/05 2:29:51 PM) Bad-Dll(IEP) in BHO: (not found)
(9/3/05 2:29:51 PM) UBF: 4 - UBB: 0 - UBR: 6
(9/3/05 2:29:51 PM) UBF: 4 - UBB: 0 - UBR: 6
(9/3/05 2:29:51 PM) Bad IE-pages: (none)
(9/3/05 2:29:51 PM) Stealth-String not found
(9/3/05 2:29:51 PM) Not infected->END


(9/3/05 2:37:54 PM) SPSeHjFix started v1.1.2
(9/3/05 2:37:54 PM) OS: WinXP Service Pack 1 (5.1.2600)
(9/3/05 2:37:54 PM) Language: english
(9/3/05 2:37:54 PM) Win-Path: C:\WINDOWS
(9/3/05 2:37:54 PM) System-Path: C:\WINDOWS\System32
(9/3/05 2:37:54 PM) Temp-Path: C:\DOCUME~1\Kevin\LOCALS~1\Temp\
(9/3/05 2:37:57 PM) Disinfection started
(9/3/05 2:37:57 PM) Bad-Dll(IEP): (not found)
(9/3/05 2:37:57 PM) Bad-Dll(IEP) in BHO: (not found)
(9/3/05 2:37:57 PM) UBF: 4 - UBB: 0 - UBR: 7
(9/3/05 2:37:57 PM) UBF: 4 - UBB: 0 - UBR: 7
(9/3/05 2:37:57 PM) Bad IE-pages: (none)
(9/3/05 2:37:57 PM) Stealth-String not found
(9/3/05 2:37:57 PM) Not infected->END

Logfile of HijackThis v1.99.1
Scan saved at 10:54:35 AM, on 9/4/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\atievxx.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\McAfee.com\VSO\mcvsshld.exe
C:\Program Files\McAfee.com\VSO\oasclnt.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Messenger\msmsgs.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\Program Files\Freenet\freenet.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\HJT\hijackthis\HijackThis.exe

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] C:\Program Files\McAfee.com\VSO\mcvsshld.exe
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: Freenet.lnk = C:\Program Files\Freenet\freenet.exe
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m…96/mcinsctl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1125000980914
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1125000973423
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/m…,26/mcgdmgr.cab
O20 - Winlogon Notify: reset5 - C:\WINDOWS\SYSTEM32\reset5.dll
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: Reset 5 - Unknown owner - C:\WINDOWS\system32\srvany.exe (file missing)


When restarting I still get the:
"Couldn't start the node, make sure FLaunch.ini has an entry javaw= pointing to javaw.exe or an entry Javaexec= pointing to a Java Runtime binary (java.exe)"

When I opened Internet Explorer McAfee showed that it deleted StartPage-DU.dll, but my homepage wasn't hijacked this time.

Is there anything else you need to know about that I haven't mentioned?