What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Browser not working properly

11 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
HJT log:

Logfile of HijackThis v1.99.1
Scan saved at 3:29:50 PM, on 2005-10-02
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\System32\brsvc01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\brss01a.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\Program Files\Executive Software\Diskeeper\DkService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
E:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\No-IP\DUC20.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
E:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\palmOne\Hotsync.exe
C:\Program Files\FireTrust\MailWasher Pro\MailWasher.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\WINDOWS\system32\BRMFRSMG.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopDisplay.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\Program Files\Mozilla Firefox\firefox.exe
E:\Program Files\HiJackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cn.ca/velocity/en_velocity.shtml
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\about.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Idea2 SidebarBrowserMonitor Class - {45AD732C-2CE2-4666-B366-B2214AD57A49} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - E:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - E:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe
O4 - HKLM\..\Run: [AHQInit] C:\Program Files\Creative\SBLive\Program\AHQInit.exe
O4 - HKLM\..\Run: [LogonStudio] "C:\Program Files\WinCustomize\LogonStudio\logonstudio.exe" /RANDOM
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [QuickFinder Scheduler] "C:\Program Files\WordPerfect Office 11\Programs\QFSCHD110.EXE"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [WinVNC] "C:\Program Files\RealVNC\WinVNC\winvnc.exe" -servicehelper
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Executive Software\Diskeeper\DkIcon.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKCU\..\Run: [FreeRAM XP] "C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" -win
O4 - Startup: MailWasherPro.lnk = C:\Program Files\FireTrust\MailWasher Pro\MailWasher.exe
O4 - Startup: Stickies.lnk = C:\Program Files\stickies\stickies.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: HotSync Manager.lnk = C:\Program Files\palmOne\Hotsync.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Subscribe in Desktop Sidebar - {09FE188B-6E85-479e-9411-51FB2220DF80} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Subscribe in Desktop Sidebar - {09FE188B-6E85-479e-9411-51FB2220DF80} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: TREND MICRO HouseCall - {2B5EA4F8-620A-4A8B-B003-4C8C5EBEA826} - http://uk.trendmicro-europe.com/enterprise…usecall_pre.php (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: ppctlcab - http://www.pestscan.com/scanner/ppctlcab.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200203…meInstaller.exe
O16 - DPF: {556DDE35-E955-11D0-A707-000000521957} - http://www.xblock.com/download/xclean_micro.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{5BAAA7D8-E57A-48C1-AB1E-D8BB115D4BB0}: Domain = ab.hsia.telus.net
O17 - HKLM\System\CCS\Services\Tcpip\..\{5BAAA7D8-E57A-48C1-AB1E-D8BB115D4BB0}: NameServer = 216.123.198.243,209.115.152.130,209.115.131.51
O17 - HKLM\System\CCS\Services\Tcpip\..\{964DF500-BD0D-4E46-B465-1A2171F74D19}: Domain = ab.hsia.telus.net
O17 - HKLM\System\CCS\Services\Tcpip\..\{964DF500-BD0D-4E46-B465-1A2171F74D19}: NameServer = 216.123.198.243,209.115.152.130,209.115.131.51
O17 - HKLM\System\CS1\Services\Tcpip\..\{5BAAA7D8-E57A-48C1-AB1E-D8BB115D4BB0}: Domain = ab.hsia.telus.net
O17 - HKLM\System\CS1\Services\Tcpip\..\{5BAAA7D8-E57A-48C1-AB1E-D8BB115D4BB0}: NameServer = 216.123.198.243,209.115.152.130,209.115.131.51
O17 - HKLM\System\CS2\Services\Tcpip\..\{5BAAA7D8-E57A-48C1-AB1E-D8BB115D4BB0}: Domain = ab.hsia.telus.net
O17 - HKLM\System\CS2\Services\Tcpip\..\{5BAAA7D8-E57A-48C1-AB1E-D8BB115D4BB0}: NameServer = 216.123.198.243,209.115.152.130,209.115.131.51
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\System32\brsvc01a.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\Diskeeper\DkService.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - E:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NoIPDUCService - Vitalwerks LLC - C:\Program Files\No-IP\DUC20.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - E:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - E:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: VNC Server (winvnc) - Unknown owner - C:\Program Files\RealVNC\WinVNC\winvnc.exe" -service (file missing)
O23 - Service: VNC Server Version 4 (WinVNC4) - Unknown owner - C:\Program Files\RealVNC\VNC4\WinVNC4.exe" -service (file missing)
Post #2
Close all programs leaving only HijackThis running. Place a check against each of the following, Click on Fix Checked

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\about.htm
O2 - BHO: Idea2 SidebarBrowserMonitor Class - {45AD732C-2CE2-4666-B366-B2214AD57A49} - (no file)
O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)
Post #3
Done - here is my new HJT log:
Logfile of HijackThis v1.99.1
Scan saved at 6:49:43 PM, on 2005-10-07
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\System32\brsvc01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\brss01a.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\Program Files\Executive Software\Diskeeper\DkService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
E:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\No-IP\DUC20.exe
E:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\ClocX\ClocX.exe
C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\palmOne\Hotsync.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\WINDOWS\system32\BRMFRSMG.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
E:\Program Files\Norton AntiVirus\OPScan.exe
E:\Program Files\HiJackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cn.ca/velocity/en_velocity.shtml
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - E:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - E:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe
O4 - HKLM\..\Run: [AHQInit] C:\Program Files\Creative\SBLive\Program\AHQInit.exe
O4 - HKLM\..\Run: [LogonStudio] "C:\Program Files\WinCustomize\LogonStudio\logonstudio.exe" /RANDOM
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [QuickFinder Scheduler] "C:\Program Files\WordPerfect Office 11\Programs\QFSCHD110.EXE"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [WinVNC] "C:\Program Files\RealVNC\WinVNC\winvnc.exe" -servicehelper
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Executive Software\Diskeeper\DkIcon.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [ClocX] C:\Program Files\ClocX\ClocX.exe
O4 - HKCU\..\Run: [FreeRAM XP] "C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" -win
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Startup: MailWasherPro.lnk = C:\Program Files\FireTrust\MailWasher Pro\MailWasher.exe
O4 - Startup: Stickies.lnk = C:\Program Files\stickies\stickies.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: HotSync Manager.lnk = C:\Program Files\palmOne\Hotsync.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Subscribe in Desktop Sidebar - {09FE188B-6E85-479e-9411-51FB2220DF80} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Subscribe in Desktop Sidebar - {09FE188B-6E85-479e-9411-51FB2220DF80} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: TREND MICRO HouseCall - {2B5EA4F8-620A-4A8B-B003-4C8C5EBEA826} - http://uk.trendmicro-europe.com/enterprise…usecall_pre.php (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: ppctlcab - http://www.pestscan.com/scanner/ppctlcab.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200203…meInstaller.exe
O16 - DPF: {556DDE35-E955-11D0-A707-000000521957} - http://www.xblock.com/download/xclean_micro.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{5BAAA7D8-E57A-48C1-AB1E-D8BB115D4BB0}: Domain = ab.hsia.telus.net
O17 - HKLM\System\CCS\Services\Tcpip\..\{5BAAA7D8-E57A-48C1-AB1E-D8BB115D4BB0}: NameServer = 216.123.198.243,209.115.152.130,209.115.131.51
O17 - HKLM\System\CCS\Services\Tcpip\..\{964DF500-BD0D-4E46-B465-1A2171F74D19}: Domain = ab.hsia.telus.net
O17 - HKLM\System\CCS\Services\Tcpip\..\{964DF500-BD0D-4E46-B465-1A2171F74D19}: NameServer = 216.123.198.243,209.115.152.130,209.115.131.51
O17 - HKLM\System\CS1\Services\Tcpip\..\{5BAAA7D8-E57A-48C1-AB1E-D8BB115D4BB0}: Domain = ab.hsia.telus.net
O17 - HKLM\System\CS1\Services\Tcpip\..\{5BAAA7D8-E57A-48C1-AB1E-D8BB115D4BB0}: NameServer = 216.123.198.243,209.115.152.130,209.115.131.51
O17 - HKLM\System\CS2\Services\Tcpip\..\{5BAAA7D8-E57A-48C1-AB1E-D8BB115D4BB0}: Domain = ab.hsia.telus.net
O17 - HKLM\System\CS2\Services\Tcpip\..\{5BAAA7D8-E57A-48C1-AB1E-D8BB115D4BB0}: NameServer = 216.123.198.243,209.115.152.130,209.115.131.51
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\System32\brsvc01a.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\Diskeeper\DkService.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - E:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NoIPDUCService - Vitalwerks LLC - C:\Program Files\No-IP\DUC20.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - E:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - E:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: VNC Server (winvnc) - Unknown owner - C:\Program Files\RealVNC\WinVNC\winvnc.exe" -service (file missing)
O23 - Service: VNC Server Version 4 (WinVNC4) - Unknown owner - C:\Program Files\RealVNC\VNC4\WinVNC4.exe" -service (file missing)
Post #4
As far as I can see the log is clean but I realy have no idea what these two programs are. C:\Program Files\ClocX C:\Program Files\YourWare Solutions
Post #5 last edited
No worries on those - both are app's that I downloaded. ClokX is an enhanced desktop clock and Yourware runs FreeRamPro (an excellent RAM optimiser). Many thanks for your assistance. How does one learn to do the things you do?
Post #7
I am still having browser problems. I am using Firefox and when I click on a link on an open web page, the page starts to open,then a pop up window opens saying the following:

"http://view.atdmt.com
Not ImplementedThe server does not support the functionality required to fulfil this request."

The page then reverts back to the original page.
I also have similar issues with IE although I get a different message and about 6 pop-ups.

Current HJT log:
Logfile of HijackThis v1.99.1
Scan saved at 11:44:52 AM, on 2005-10-12
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\System32\brsvc01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\brss01a.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
E:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\No-IP\DUC20.exe
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\Explorer.EXE
E:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\ClocX\ClocX.exe
C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\palmOne\Hotsync.exe
C:\Program Files\FireTrust\MailWasher Pro\MailWasher.exe
C:\WINDOWS\system32\BRMFRSMG.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopDisplay.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\PROGRA~1\MICROS~2\Office10\OUTLOOK.EXE
C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
C:\Program Files\FileMaker\FileMaker Pro 6\FileMaker Pro.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
E:\Program Files\HiJackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cn.ca/velocity/en_velocity.shtml
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - E:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - E:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe
O4 - HKLM\..\Run: [AHQInit] C:\Program Files\Creative\SBLive\Program\AHQInit.exe
O4 - HKLM\..\Run: [LogonStudio] "C:\Program Files\WinCustomize\LogonStudio\logonstudio.exe" /RANDOM
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [QuickFinder Scheduler] "C:\Program Files\WordPerfect Office 11\Programs\QFSCHD110.EXE"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [WinVNC] "C:\Program Files\RealVNC\WinVNC\winvnc.exe" -servicehelper
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [ClocX] C:\Program Files\ClocX\ClocX.exe
O4 - HKCU\..\Run: [FreeRAM XP] "C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" -win
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Startup: MailWasherPro.lnk = C:\Program Files\FireTrust\MailWasher Pro\MailWasher.exe
O4 - Startup: Stickies.lnk = C:\Program Files\stickies\stickies.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: HotSync Manager.lnk = C:\Program Files\palmOne\Hotsync.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Subscribe in Desktop Sidebar - {09FE188B-6E85-479e-9411-51FB2220DF80} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Subscribe in Desktop Sidebar - {09FE188B-6E85-479e-9411-51FB2220DF80} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: TREND MICRO HouseCall - {2B5EA4F8-620A-4A8B-B003-4C8C5EBEA826} - http://uk.trendmicro-europe.com/enterprise…usecall_pre.php (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: ppctlcab - http://www.pestscan.com/scanner/ppctlcab.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200203…meInstaller.exe
O16 - DPF: {556DDE35-E955-11D0-A707-000000521957} - http://www.xblock.com/download/xclean_micro.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{5BAAA7D8-E57A-48C1-AB1E-D8BB115D4BB0}: Domain = ab.hsia.telus.net
O17 - HKLM\System\CCS\Services\Tcpip\..\{5BAAA7D8-E57A-48C1-AB1E-D8BB115D4BB0}: NameServer = 216.123.198.243,209.115.152.130,209.115.131.51
O17 - HKLM\System\CCS\Services\Tcpip\..\{964DF500-BD0D-4E46-B465-1A2171F74D19}: Domain = ab.hsia.telus.net
O17 - HKLM\System\CCS\Services\Tcpip\..\{964DF500-BD0D-4E46-B465-1A2171F74D19}: NameServer = 216.123.198.243,209.115.152.130,209.115.131.51
O17 - HKLM\System\CS1\Services\Tcpip\..\{5BAAA7D8-E57A-48C1-AB1E-D8BB115D4BB0}: Domain = ab.hsia.telus.net
O17 - HKLM\System\CS1\Services\Tcpip\..\{5BAAA7D8-E57A-48C1-AB1E-D8BB115D4BB0}: NameServer = 216.123.198.243,209.115.152.130,209.115.131.51
O17 - HKLM\System\CS2\Services\Tcpip\..\{5BAAA7D8-E57A-48C1-AB1E-D8BB115D4BB0}: Domain = ab.hsia.telus.net
O17 - HKLM\System\CS2\Services\Tcpip\..\{5BAAA7D8-E57A-48C1-AB1E-D8BB115D4BB0}: NameServer = 216.123.198.243,209.115.152.130,209.115.131.51
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\System32\brsvc01a.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - E:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NoIPDUCService - Vitalwerks LLC - C:\Program Files\No-IP\DUC20.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - E:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - E:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: VNC Server (winvnc) - Unknown owner - C:\Program Files\RealVNC\WinVNC\winvnc.exe" -service (file missing)
O23 - Service: VNC Server Version 4 (WinVNC4) - Unknown owner - C:\Program Files\RealVNC\VNC4\WinVNC4.exe" -service (file missing)
Post #9
Please download Ewido Security Suite it is a trial version of the program.
  • Install ewido security suite
  • Launch ewido, there should be an icon on your desktop double-click it.
  • The program will now go to the main screen
You will need to update ewido to the latest definition files.
  • On the left hand side of the main screen click update
  • Then click on Start Update
The update will start and a progress bar will show the updates being installed.
If you are having problems with the updater, you can use this link to manually update Ewido.
Ewido manual updates

Once the updates are installed do the following:
  • Click on scanner
  • Click on Complete System Scan and the scan will begin.
  • NOTE: During some scans with ewido it is finding cases of false positives.**
    • You will need to step through the process of cleaning files one-by-one.
    • If ewido detects a file you KNOW to be legitimate, select none as the action.
    • DO NOT select "Perform action on all infections"
    • If you are unsure of any entry found select none for now.
  • Once the scan has completed, there will be a button located on the bottom of the screen named Save report
  • Click Save report.
  • Save the report .txt file to your desktop.
Now close ewido security suite.
**(Ewido for example has been flagging parts of AVG Anti-Virus, pcAnywhere and the game "Risk")
Post #10
——————————————————— ewido security suite - Scan report ——————————————————— + Created on: 9:13:51 AM, 2005-10-13 + Report-Checksum: 1FCD6CCD + Scan result: :mozilla.18:C:\Documents and Settings\Richard Radu\Application Data\Mozilla\Firefox\Profiles\bk4ersup.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.19:C:\Documents and Settings\Richard Radu\Application Data\Mozilla\Firefox\Profiles\bk4ersup.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.20:C:\Documents and Settings\Richard Radu\Application Data\Mozilla\Firefox\Profiles\bk4ersup.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.21:C:\Documents and Settings\Richard Radu\Application Data\Mozilla\Firefox\Profiles\bk4ersup.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.30:C:\Documents and Settings\Richard Radu\Application Data\Mozilla\Firefox\Profiles\bk4ersup.default\cookies.txt -> Spyware.Cookie.247realmedia : Cleaned with backup :mozilla.31:C:\Documents and Settings\Richard Radu\Application Data\Mozilla\Firefox\Profiles\bk4ersup.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.41:C:\Documents and Settings\Richard Radu\Application Data\Mozilla\Firefox\Profiles\bk4ersup.default\cookies.txt -> Spyware.Cookie.Com : Cleaned with backup :mozilla.42:C:\Documents and Settings\Richard Radu\Application Data\Mozilla\Firefox\Profiles\bk4ersup.default\cookies.txt -> Spyware.Cookie.Com : Cleaned with backup :mozilla.53:C:\Documents and Settings\Richard Radu\Application Data\Mozilla\Firefox\Profiles\bk4ersup.default\cookies.txt -> Spyware.Cookie.Pro-market : Cleaned with backup C:\Documents and Settings\Richard Radu\Local Settings\Application Data\Wildtangent\Cdacache\00\00\0D.dat/files\wtvh.dll -> Spyware.WildTangent : Cleaned with backup C:\WINDOWS\SYSTEM32\BO2802040113.dll -> Spyware.BargainBuddy : Cleaned with backup C:\WINDOWS\SYSTEM32\SHAgentNew.dll -> Spyware.BargainBuddy : Cleaned with backup :mozilla.11:E:\Documents and Settings\Richard Radu\Application Data\Mozilla\Firefox\Profiles\bk4ersup.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.12:E:\Documents and Settings\Richard Radu\Application Data\Mozilla\Firefox\Profiles\bk4ersup.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.14:E:\Documents and Settings\Richard Radu\Application Data\Mozilla\Firefox\Profiles\bk4ersup.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.15:E:\Documents and Settings\Richard Radu\Application Data\Mozilla\Firefox\Profiles\bk4ersup.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.16:E:\Documents and Settings\Richard Radu\Application Data\Mozilla\Firefox\Profiles\bk4ersup.default\cookies.txt -> Spyware.Cookie.Doubleclick : Cleaned with backup :mozilla.24:E:\Documents and Settings\Richard Radu\Application Data\Mozilla\Firefox\Profiles\bk4ersup.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.25:E:\Documents and Settings\Richard Radu\Application Data\Mozilla\Firefox\Profiles\bk4ersup.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.28:E:\Documents and Settings\Richard Radu\Application Data\Mozilla\Firefox\Profiles\bk4ersup.default\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup :mozilla.29:E:\Documents and Settings\Richard Radu\Application Data\Mozilla\Firefox\Profiles\bk4ersup.default\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup :mozilla.31:E:\Documents and Settings\Richard Radu\Application Data\Mozilla\Firefox\Profiles\bk4ersup.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.47:E:\Documents and Settings\Richard Radu\Application Data\Mozilla\Firefox\Profiles\bk4ersup.default\cookies.txt -> Spyware.Cookie.Mediaplex : Cleaned with backup :mozilla.50:E:\Documents and Settings\Richard Radu\Application Data\Mozilla\Firefox\Profiles\bk4ersup.default\cookies.txt -> Spyware.Cookie.Burstnet : Cleaned with backup :mozilla.51:E:\Documents and Settings\Richard Radu\Application Data\Mozilla\Firefox\Profiles\bk4ersup.default\cookies.txt -> Spyware.Cookie.Burstnet : Cleaned with backup :mozilla.61:E:\Documents and Settings\Richard Radu\Application Data\Mozilla\Firefox\Profiles\bk4ersup.default\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup :mozilla.62:E:\Documents and Settings\Richard Radu\Application Data\Mozilla\Firefox\Profiles\bk4ersup.default\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup :mozilla.73:E:\Documents and Settings\Richard Radu\Application Data\Mozilla\Firefox\Profiles\bk4ersup.default\cookies.txt -> Spyware.Cookie.Webtrendslive : Cleaned with backup :mozilla.76:E:\Documents and Settings\Richard Radu\Application Data\Mozilla\Firefox\Profiles\bk4ersup.default\cookies.txt -> Spyware.Cookie.Com : Cleaned with backup :mozilla.78:E:\Documents and Settings\Richard Radu\Application Data\Mozilla\Firefox\Profiles\bk4ersup.default\cookies.txt -> Spyware.Cookie.Com : Cleaned with backup :mozilla.79:E:\Documents and Settings\Richard Radu\Application Data\Mozilla\Firefox\Profiles\bk4ersup.default\cookies.txt -> Spyware.Cookie.Questionmarket : Cleaned with backup :mozilla.85:E:\Documents and Settings\Richard Radu\Application Data\Mozilla\Firefox\Profiles\bk4ersup.default\cookies.txt -> Spyware.Cookie.247realmedia : Cleaned with backup :mozilla.86:E:\Documents and Settings\Richard Radu\Application Data\Mozilla\Firefox\Profiles\bk4ersup.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.87:E:\Documents and Settings\Richard Radu\Application Data\Mozilla\Firefox\Profiles\bk4ersup.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.88:E:\Documents and Settings\Richard Radu\Application Data\Mozilla\Firefox\Profiles\bk4ersup.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.89:E:\Documents and Settings\Richard Radu\Application Data\Mozilla\Firefox\Profiles\bk4ersup.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.90:E:\Documents and Settings\Richard Radu\Application Data\Mozilla\Firefox\Profiles\bk4ersup.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.91:E:\Documents and Settings\Richard Radu\Application Data\Mozilla\Firefox\Profiles\bk4ersup.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.93:E:\Documents and Settings\Richard Radu\Application Data\Mozilla\Firefox\Profiles\bk4ersup.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.94:E:\Documents and Settings\Richard Radu\Application Data\Mozilla\Firefox\Profiles\bk4ersup.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.95:E:\Documents and Settings\Richard Radu\Application Data\Mozilla\Firefox\Profiles\bk4ersup.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.108:E:\Documents and Settings\Richard Radu\Application Data\Mozilla\Firefox\Profiles\bk4ersup.default\cookies.txt -> Spyware.Cookie.Valueclick : Cleaned with backup :mozilla.110:E:\Documents and Settings\Richard Radu\Application Data\Mozilla\Firefox\Profiles\bk4ersup.default\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup :mozilla.111:E:\Documents and Settings\Richard Radu\Application Data\Mozilla\Firefox\Profiles\bk4ersup.default\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup :mozilla.113:E:\Documents and Settings\Richard Radu\Application Data\Mozilla\Firefox\Profiles\bk4ersup.default\cookies.txt -> Spyware.Cookie.Liveperson : Cleaned with backup :mozilla.114:E:\Documents and Settings\Richard Radu\Application Data\Mozilla\Firefox\Profiles\bk4ersup.default\cookies.txt -> Spyware.Cookie.Liveperson : Cleaned with backup :mozilla.115:E:\Documents and Settings\Richard Radu\Application Data\Mozilla\Firefox\Profiles\bk4ersup.default\cookies.txt -> Spyware.Cookie.Liveperson : Cleaned with backup :mozilla.116:E:\Documents and Settings\Richard Radu\Application Data\Mozilla\Firefox\Profiles\bk4ersup.default\cookies.txt -> Spyware.Cookie.Liveperson : Cleaned with backup :mozilla.124:E:\Documents and Settings\Richard Radu\Application Data\Mozilla\Firefox\Profiles\bk4ersup.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.126:E:\Documents and Settings\Richard Radu\Application Data\Mozilla\Firefox\Profiles\bk4ersup.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.127:E:\Documents and Settings\Richard Radu\Application Data\Mozilla\Firefox\Profiles\bk4ersup.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup :mozilla.128:E:\Documents and Settings\Richard Radu\Application Data\Mozilla\Firefox\Profiles\bk4ersup.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup :mozilla.129:E:\Documents and Settings\Richard Radu\Application Data\Mozilla\Firefox\Profiles\bk4ersup.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup :mozilla.130:E:\Documents and Settings\Richard Radu\Application Data\Mozilla\Firefox\Profiles\bk4ersup.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup :mozilla.131:E:\Documents and Settings\Richard Radu\Application Data\Mozilla\Firefox\Profiles\bk4ersup.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.132:E:\Documents and Settings\Richard Radu\Application Data\Mozilla\Firefox\Profiles\bk4ersup.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.133:E:\Documents and Settings\Richard Radu\Application Data\Mozilla\Firefox\Profiles\bk4ersup.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.137:E:\Documents and Settings\Richard Radu\Application Data\Mozilla\Firefox\Profiles\bk4ersup.default\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup :mozilla.138:E:\Documents and Settings\Richard Radu\Application Data\Mozilla\Firefox\Profiles\bk4ersup.default\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup :mozilla.143:E:\Documents and Settings\Richard Radu\Application Data\Mozilla\Firefox\Profiles\bk4ersup.default\cookies.txt -> Spyware.Cookie.Webtrendslive : Cleaned with backup :mozilla.162:E:\Documents and Settings\Richard Radu\Application Data\Mozilla\Firefox\Profiles\bk4ersup.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.163:E:\Documents and Settings\Richard Radu\Application Data\Mozilla\Firefox\Profiles\bk4ersup.default\cookies.txt -> Spyware.Cookie.Webtrendslive : Cleaned with backup :mozilla.176:E:\Documents and Settings\Richard Radu\Application Data\Mozilla\Firefox\Profiles\bk4ersup.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.187:E:\Documents and Settings\Richard Radu\Application Data\Mozilla\Firefox\Profiles\bk4ersup.default\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup :mozilla.188:E:\Documents and Settings\Richard Radu\Application Data\Mozilla\Firefox\Profiles\bk4ersup.default\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup :mozilla.192:E:\Documents and Settings\Richard Radu\Application Data\Mozilla\Firefox\Profiles\bk4ersup.default\cookies.txt -> Spyware.Cookie.Clickhype : Cleaned with backup :mozilla.194:E:\Documents and Settings\Richard Radu\Application Data\Mozilla\Firefox\Profiles\bk4ersup.default\cookies.txt -> Spyware.Cookie.Bluestreak : Cleaned with backup :mozilla.204:E:\Documents and Settings\Richard Radu\Application Data\Mozilla\Firefox\Profiles\bk4ersup.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup :mozilla.205:E:\Documents and Settings\Richard Radu\Application Data\Mozilla\Firefox\Profiles\bk4ersup.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup :mozilla.206:E:\Documents and Settings\Richard Radu\Application Data\Mozilla\Firefox\Profiles\bk4ersup.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup :mozilla.207:E:\Documents and Settings\Richard Radu\Application Data\Mozilla\Firefox\Profiles\bk4ersup.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup :mozilla.208:E:\Documents and Settings\Richard Radu\Application Data\Mozilla\Firefox\Profiles\bk4ersup.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup E:\Documents and Settings\Richard Radu\Cookies\richard [removed][2].txt -> Spyware.Cookie.Liveperson : Cleaned with backup E:\Documents and Settings\Richard Radu\Local Settings\Application Data\Wildtangent\Cdacache\00\00\0D.dat/files\wtvh.dll -> Spyware.WildTangent : Cleaned with backup E:\WINDOWS\SYSTEM32\BO2802040113.dll -> Spyware.BargainBuddy : Cleaned with backup E:\WINDOWS\SYSTEM32\SHAgentNew.dll -> Spyware.BargainBuddy : Cleaned with backup ::Report End
Post #14
You can keep it for 30 days. Then remove it but if you get infected again then you'll have to pay for it. :huh:

Please follow a few tips to remain malware free:

Make sure you keep your Windows OS current by visiting Windows update
occasionaly to download and install any critical updates and service packs. With out these you are leaving the backdoor open.

Also download, install and keep updated- Antivirus Software (and use only one):
Free for home users:
avast! 4 Home Edition Download
AVG free version 7.0 AVG free version v6.0 updates ended 12/31/04
AntiVir Personal Edition

Adjust your browser settings: Change your(active x) settings in IE. With IE open go to tools, internet options, security tab. Click on the internet globe, then custom level. Set the first option "download signed active x controls" to prompt, the next two to disable. Read more:
Internet Explorer Privacy & Security Settings
Working with Internet Explorer 6 Security
Many exploits are directed at Internet Explorer, you dont have to use it. Try a different browser:
Like Firefox,
And Thunderbird for controling spam in your e-mail.

Install a firewall. A firewall will control what comes in from the internet and what leaves your computer to the internet. A firewall will also alert you when a application trys to connect to the internet from your computer, this is a good way to catch crapware or trojans, trying to connect out bound from your computer- whats that and why does it need a internet connection? You can deny it access it until more investigation is done. Zone Alarm is a free and easy to use firewall, that will provide in and outbound protection. Microsoft XP firewall only provides inbound protection, but is not as robust as third party firewalls, Be sure to run only >one< firewall.If you use another, be sure to disable XP's built in firewall.A inexpensive NAT hardware router with SPI (firewall)would be even better,along with a software firewall.
Zone Alarm
Kerio Personal Firewall
Outpost Firewall

Download, install and update before using:(if these are constantly finding malware, then you need to make some changes)
Ad-Aware SE Personal edition
Spybot Search and destroy
Becarful with spyware "removers and scanners"– there are many "rogue/suspect" programs that "claim to remove" spyware.

Other programs to consider:
SpywareBlaster
IE-SPYAD
AntiTrojan software to fill in the gap:
a2 free
Ewido Security Suite
Trojan Hunter (30 day trial version)

Learn More:
Tony's article So how did I get infected in the first place?
How to Secure (and Keep Secure) My (New) Computer(s)
Home Computer Security
Wilders Security Advisors

Watch what you download, and where you download it from.
Many programs come bundled with "extra" crapware you may not want. Make sure you know what it is you will be downloading and installing. Visit the makers website, learn more about the program, Does the program you want come bundled with other "3rd party" programs? What do the 3rd party programs do? Will they deliver ads? Track your surfing habits?.You may be installing more than you think, Read the EULA agreement, you know that paragraph of stuff you "agree to" before the software installs? Stay away from warez and crack sites. Becarful what you download from file sharing networks.If you are not sure, scan it with your Antivirus app. A small file (in KB) is probably not what you think it is. Some p2p clients also install 3rd party stuff you probably dont want.
Post #15
It's doing it again - I am getting the exact same pop-ups!!
Things were perfect until I visited PCWorld.com - I know that this is a safe site as I have visited it many times. I Googled the problem without much luck but I found that the CNET site is having similar issues.

Today's HJT log:

Logfile of HijackThis v1.99.1
Scan saved at 8:04:45 AM, on 2005-10-17
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\System32\brsvc01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\brss01a.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
E:\Program Files\ewido\security suite\ewidoctrl.exe
E:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
E:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\No-IP\DUC20.exe
E:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\WINDOWS\system32\BRMFRSMG.EXE
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\ClocX\ClocX.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopDisplay.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
E:\Program Files\Free Download Manager\fdm.exe
E:\Program Files\Shareaza\Shareaza.exe
C:\PROGRA~1\FASTDE~1\FAST2.EXE
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\palmOne\Hotsync.exe
C:\Program Files\FireTrust\MailWasher Pro\MailWasher.exe
C:\Program Files\stickies\stickies.exe
C:\Program Files\FileMaker\FileMaker Pro 6\FileMaker Pro.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
E:\Program Files\HiJackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cn.ca/velocity/en_velocity.shtml
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - E:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - E:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe
O4 - HKLM\..\Run: [AHQInit] C:\Program Files\Creative\SBLive\Program\AHQInit.exe
O4 - HKLM\..\Run: [LogonStudio] "C:\Program Files\WinCustomize\LogonStudio\logonstudio.exe" /RANDOM
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [QuickFinder Scheduler] "C:\Program Files\WordPerfect Office 11\Programs\QFSCHD110.EXE"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [WinVNC] "C:\Program Files\RealVNC\WinVNC\winvnc.exe" -servicehelper
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [ClocX] C:\Program Files\ClocX\ClocX.exe
O4 - HKCU\..\Run: [FreeRAM XP] "C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" -win
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Free Download Manager] E:\Program Files\Free Download Manager\fdm.exe -autorun
O4 - HKCU\..\Run: [Shareaza] "E:\Program Files\Shareaza\Shareaza.exe" -tray
O4 - HKCU\..\Run: [FAST Defrag] C:\PROGRA~1\FASTDE~1\FAST2.EXE -tray
O4 - Startup: MailWasherPro.lnk = C:\Program Files\FireTrust\MailWasher Pro\MailWasher.exe
O4 - Startup: Stickies.lnk = C:\Program Files\stickies\stickies.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: HotSync Manager.lnk = C:\Program Files\palmOne\Hotsync.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Download all by Free Download Manager - file://E:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download by Free Download Manager - file://E:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: Download selected by Free Download Manager - file://E:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Download web site by Free Download Manager - file://E:\Program Files\Free Download Manager\dlpage.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Subscribe in Desktop Sidebar - {09FE188B-6E85-479e-9411-51FB2220DF80} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Subscribe in Desktop Sidebar - {09FE188B-6E85-479e-9411-51FB2220DF80} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: TREND MICRO HouseCall - {2B5EA4F8-620A-4A8B-B003-4C8C5EBEA826} - http://uk.trendmicro-europe.com/enterprise…usecall_pre.php (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: ppctlcab - http://www.pestscan.com/scanner/ppctlcab.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200203…meInstaller.exe
O16 - DPF: {556DDE35-E955-11D0-A707-000000521957} - http://www.xblock.com/download/xclean_micro.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{5BAAA7D8-E57A-48C1-AB1E-D8BB115D4BB0}: Domain = ab.hsia.telus.net
O17 - HKLM\System\CCS\Services\Tcpip\..\{5BAAA7D8-E57A-48C1-AB1E-D8BB115D4BB0}: NameServer = 216.123.198.243,209.115.152.130,209.115.131.51
O17 - HKLM\System\CCS\Services\Tcpip\..\{964DF500-BD0D-4E46-B465-1A2171F74D19}: Domain = ab.hsia.telus.net
O17 - HKLM\System\CCS\Services\Tcpip\..\{964DF500-BD0D-4E46-B465-1A2171F74D19}: NameServer = 216.123.198.243,209.115.152.130,209.115.131.51
O17 - HKLM\System\CS1\Services\Tcpip\..\{5BAAA7D8-E57A-48C1-AB1E-D8BB115D4BB0}: Domain = ab.hsia.telus.net
O17 - HKLM\System\CS1\Services\Tcpip\..\{5BAAA7D8-E57A-48C1-AB1E-D8BB115D4BB0}: NameServer = 216.123.198.243,209.115.152.130,209.115.131.51
O17 - HKLM\System\CS2\Services\Tcpip\..\{5BAAA7D8-E57A-48C1-AB1E-D8BB115D4BB0}: Domain = ab.hsia.telus.net
O17 - HKLM\System\CS2\Services\Tcpip\..\{5BAAA7D8-E57A-48C1-AB1E-D8BB115D4BB0}: NameServer = 216.123.198.243,209.115.152.130,209.115.131.51
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\System32\brsvc01a.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: ewido security suite control - ewido networks - E:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - E:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - E:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NoIPDUCService - Vitalwerks LLC - C:\Program Files\No-IP\DUC20.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - E:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - E:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: VNC Server (winvnc) - Unknown owner - C:\Program Files\RealVNC\WinVNC\winvnc.exe" -service (file missing)
O23 - Service: VNC Server Version 4 (WinVNC4) - Unknown owner - C:\Program Files\RealVNC\VNC4\WinVNC4.exe" -service (file missing)

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI