What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

problems with spyware not removed by counterspy

5 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Not sure how this works but one of the technicians at counterspy asked me to post this logfile here in the hope that someone would be able to give me advice on how to remove spyware from my home pc which counterspy appears unable to do so - i keep getting counterspy telling me that i have a trojanstartup.nameshifter, a CWS.NS3 and CWS.aboutblank as well as others that keep popping up. Thanks for any advice.

S


Logfile of HijackThis v1.99.1
Scan saved at 6:47:33 p.m., on 4/10/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Sunbelt Software\CounterSpy\Consumer\sunThreatEngine.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Sunbelt Software\CounterSpy\Consumer\SunProtectionServer.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe
C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe
C:\Program Files\Alcatel\Dragdiag.exe
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\system32\crsb32.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Sunbelt Software\CounterSpy\Consumer\sunserver.exe
C:\Program Files\Compaq\Easy Access Button Support\CPQEADM.EXE
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Compaq\EAKDRV\EAUSBKBD.EXE
C:\PROGRA~1\Compaq\EASYAC~1\BttnServ.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\Program Files\Microsoft Office\Office10\OUTLOOK.EXE
C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
C:\WINDOWS\System32\wisptis.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\Sunbelt Software\CounterSpy\Consumer\SunServAlert.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\unzipped\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\xpgcp.dll/sp.html#83556
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\riadh.dll/sp.html#83556
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\xpgcp.dll/sp.html#83556
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\xpgcp.dll/sp.html#83556
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\xpgcp.dll/sp.html#83556
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\xpgcp.dll/sp.html#83556
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\xpgcp.dll/sp.html#83556
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Class - {093585F1-45A2-F3FD-5DC8-CE8C707B844B} - C:\WINDOWS\ipsy.dll (file missing)
O2 - BHO: Class - {0AE716A6-1EDA-411D-6031-97E7FA0907DD} - C:\WINDOWS\system32\apiyh.dll (file missing)
O2 - BHO: Class - {0B5661F6-E169-C5E2-B4B1-47BCE745AF26} - C:\WINDOWS\system32\atlnw.dll (file missing)
O2 - BHO: Class - {1536ACBD-A373-3F26-8F48-46BE2D830EF0} - C:\WINDOWS\system32\ienx.dll (file missing)
O2 - BHO: Class - {1706490A-46E4-DD57-A8BB-9E0DE0B66E7B} - C:\WINDOWS\crqd32.dll (file missing)
O2 - BHO: Class - {20FBF908-0E40-FE23-831C-A7091EC44CAE} - C:\WINDOWS\system32\addpu.dll (file missing)
O2 - BHO: Class - {24817430-5142-4C7E-9CFF-0DCF7AC3D4C9} - C:\WINDOWS\system32\sysvf32.dll (file missing)
O2 - BHO: Class - {26EB855E-8020-394A-64FD-DB123824DB35} - C:\WINDOWS\javaqf.dll (file missing)
O2 - BHO: Class - {2824CF77-AF01-AB9B-0E03-B55D8EAF18D4} - C:\WINDOWS\d3il32.dll (file missing)
O2 - BHO: Class - {29B4E47E-E6A8-7CE4-67AD-EBB35E41D7C2} - C:\WINDOWS\system32\winbz32.dll (file missing)
O2 - BHO: Class - {2ABA8EC8-43E6-7C24-9568-068569082C70} - C:\WINDOWS\system32\javaes.dll (file missing)
O2 - BHO: Class - {2B7DA50D-14B4-6A84-5DA6-C94EF1A69AAB} - C:\WINDOWS\iehk.dll (file missing)
O2 - BHO: Class - {2FC68BAA-E00A-CB9F-C91B-DCEDFBEFA258} - C:\WINDOWS\apiuw.dll (file missing)
O2 - BHO: Class - {32646C8A-BB54-7D47-C6A8-722B0FA51A6C} - C:\WINDOWS\system32\atlzh32.dll (file missing)
O2 - BHO: Class - {39497903-FC95-F850-8965-3C13F3D7274A} - C:\WINDOWS\system32\winbb.dll (file missing)
O2 - BHO: Class - {3C41D032-236A-13C4-286A-0128CEB6BBEF} - C:\WINDOWS\system32\apism.dll (file missing)
O2 - BHO: Class - {3E634ABC-AA83-3403-5DD5-43546E8735F1} - C:\WINDOWS\system32\sysxg32.dll (file missing)
O2 - BHO: Class - {44FF9B6E-F797-2D86-0148-1DE3BCB54D24} - C:\WINDOWS\netmd.dll (file missing)
O2 - BHO: Class - {4CF3F22B-5DA9-5DE0-5DEB-EE4100912572} - C:\WINDOWS\netiq32.dll (file missing)
O2 - BHO: Class - {4D46E395-B9CE-F003-30B8-9B4EB6EACBD3} - C:\WINDOWS\netns32.dll
O2 - BHO: Class - {4E3683EC-EDA1-0338-4DF4-D571699FD262} - C:\WINDOWS\system32\mfcds32.dll (file missing)
O2 - BHO: Class - {524102DB-A22C-9350-6565-DE17AF479294} - C:\WINDOWS\system32\netbu32.dll (file missing)
O2 - BHO: Class - {55F20EFF-2F9C-BDB0-B7CF-8E85DA740089} - C:\WINDOWS\system32\d3pa.dll (file missing)
O2 - BHO: Class - {599586A7-52FB-1A19-3150-DD3446C41F79} - C:\WINDOWS\ntyv.dll (file missing)
O2 - BHO: Class - {5AC5C3B9-9CEC-BC17-DFFB-3F33F50B8236} - C:\WINDOWS\winlb.dll (file missing)
O2 - BHO: Class - {5AD33BA6-7ADF-0FBE-C0F0-7C18C405DE9E} - C:\WINDOWS\netlz32.dll (file missing)
O2 - BHO: Class - {5CD71DC4-F3DB-2684-1DD2-B8F55F150CDE} - C:\WINDOWS\system32\ipni32.dll (file missing)
O2 - BHO: Class - {5E5E70C2-E430-0AAF-8ECE-321F9B1C4F50} - C:\WINDOWS\system32\msdz.dll (file missing)
O2 - BHO: Class - {5EB8144B-6EF2-7346-72E4-ADB028205C5E} - C:\WINDOWS\system32\netks32.dll (file missing)
O2 - BHO: Class - {64CDF8EE-8744-A3BF-4F77-0ADBBEE622A8} - C:\WINDOWS\system32\apiwx.dll (file missing)
O2 - BHO: Class - {6763EDCB-2C49-F4B4-713C-E8F6A5E7D81E} - C:\WINDOWS\winfm.dll (file missing)
O2 - BHO: Class - {69535ABC-0AE9-CD1D-1A43-88C6797D9B6E} - C:\WINDOWS\addrv.dll (file missing)
O2 - BHO: Class - {6B2B1D4A-827F-5433-DF52-88CA090883DD} - C:\WINDOWS\system32\d3gf32.dll (file missing)
O2 - BHO: Class - {6C2A592C-2CEB-91F6-ABFC-8A6CAA196309} - C:\WINDOWS\d3mw32.dll (file missing)
O2 - BHO: Class - {6D33AC15-1E7C-6792-3A0F-7F24E39ABC19} - C:\WINDOWS\syszq32.dll (file missing)
O2 - BHO: Class - {6E211685-27D7-C653-853B-75B6D59AC151} - C:\WINDOWS\system32\apphb.dll (file missing)
O2 - BHO: Class - {6F75ABBF-6008-EDA7-8453-2ADF8601ADFA} - C:\WINDOWS\msof32.dll (file missing)
O2 - BHO: Class - {713B605D-71E8-169E-A30F-39C4603AF036} - C:\WINDOWS\system32\javaou32.dll (file missing)
O2 - BHO: Class - {75AB9EE4-0E8F-7F96-4A65-7E768261D1CA} - C:\WINDOWS\system32\iefb.dll (file missing)
O2 - BHO: Class - {7E678766-5C45-3E67-EFD2-B3449A8C2A69} - C:\WINDOWS\winnk.dll (file missing)
O2 - BHO: Class - {820EE400-4068-7AC4-7934-F519A5AC7D69} - C:\WINDOWS\system32\sdkwo.dll (file missing)
O2 - BHO: Class - {866A3A28-5F61-83BA-C3CA-AA1516A9ABFB} - C:\WINDOWS\atlbi32.dll (file missing)
O2 - BHO: Class - {868B9A8E-F8FF-0CE7-B336-2B1AF1713C5F} - C:\WINDOWS\addvi32.dll (file missing)
O2 - BHO: Class - {8757DCF3-EDCB-AF1D-2A96-1BA99BF8F486} - C:\WINDOWS\sdkyy.dll (file missing)
O2 - BHO: Class - {883EDD1C-FC42-B1BC-75A1-920AD1D28523} - C:\WINDOWS\addrx32.dll (file missing)
O2 - BHO: Class - {8B82102E-F491-66D2-F758-5BB004FEE44C} - C:\WINDOWS\windd.dll (file missing)
O2 - BHO: Class - {906797F2-8B34-E847-8C8D-3155F09D9D9E} - C:\WINDOWS\netof.dll (file missing)
O2 - BHO: Class - {92A72092-878E-DBA3-15F0-ADF6FD6C738B} - C:\WINDOWS\appxs32.dll (file missing)
O2 - BHO: Class - {97E69A69-394F-FEBB-02E2-194D4BE08C63} - C:\WINDOWS\ipej32.dll (file missing)
O2 - BHO: Class - {983F54F7-9CFC-69CC-4991-DEFEE8A65CCE} - C:\WINDOWS\addcp.dll (file missing)
O2 - BHO: Class - {9A931858-10E5-A8C8-DEAB-9C22D8F760CE} - C:\WINDOWS\atlxx.dll (file missing)
O2 - BHO: Class - {A16A74CA-2FA4-7746-A5FB-F309CC45452C} - C:\WINDOWS\system32\applm.dll (file missing)
O2 - BHO: Class - {A40065FF-BD8D-CBD6-9113-F234816A3EC3} - C:\WINDOWS\system32\crsh.dll (file missing)
O2 - BHO: Class - {A4AD1BD7-C167-5175-E4ED-1A49E67AE91E} - C:\WINDOWS\javacj.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Class - {B043489C-6BF0-01EB-E5BD-CE306F545707} - C:\WINDOWS\system32\ieju.dll (file missing)
O2 - BHO: Class - {B35E41D7-21EB-4FC8-369F-8EDCA0E710E9} - C:\WINDOWS\ntkd32.dll (file missing)
O2 - BHO: Class - {B36A4008-5663-2ECF-9E70-FA3F4CC8F486} - C:\WINDOWS\mfcqd.dll (file missing)
O2 - BHO: Class - {B5C669AE-EA19-B1C5-01F0-6512716B3157} - C:\WINDOWS\system32\ipuz.dll (file missing)
O2 - BHO: Class - {B83AC734-1261-571F-007C-D7C45405AF82} - C:\WINDOWS\system32\ntiu32.dll (file missing)
O2 - BHO: Class - {BDA708A5-8020-F30C-6759-546F47B30DFD} - C:\WINDOWS\appjd.dll (file missing)
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: Class - {C199CC42-9314-C988-794C-4F514B66252B} - C:\WINDOWS\system32\msrg32.dll (file missing)
O2 - BHO: Class - {CBE5A8A2-4CC5-4DF2-2929-3684A8D4A515} - C:\WINDOWS\system32\winpo32.dll (file missing)
O2 - BHO: Class - {D0092D6F-9A27-013B-CDD5-2A7FC6907D07} - C:\WINDOWS\system32\mfcgb32.dll (file missing)
O2 - BHO: Class - {D5803A75-94E4-D765-5CDA-5E6515E89C3E} - C:\WINDOWS\system32\apixj32.dll (file missing)
O2 - BHO: Class - {D741F288-69CD-DC65-04EF-24D24A69D9CD} - C:\WINDOWS\system32\addbk.dll (file missing)
O2 - BHO: Class - {D826F49A-10DC-6D1F-DF97-5115D71C2FF9} - C:\WINDOWS\system32\addth32.dll (file missing)
O2 - BHO: Class - {DB34B7F0-D490-5205-7CAE-49DCC4F42315} - C:\WINDOWS\ntgk32.dll (file missing)
O2 - BHO: Class - {DDF6B14C-567D-8D1E-21D4-2CACE1295ABB} - C:\WINDOWS\systv32.dll (file missing)
O2 - BHO: Class - {DFBFB007-0C50-3E65-C735-D84AD307C759} - C:\WINDOWS\system32\d3yb.dll (file missing)
O2 - BHO: Class - {E2F0712F-9E43-CF54-86D0-C0E27572FBE1} - C:\WINDOWS\system32\crte32.dll (file missing)
O2 - BHO: Class - {E4E213AC-6EE7-E7FD-1EB7-48256674F698} - C:\WINDOWS\system32\ipqo.dll (file missing)
O2 - BHO: Class - {E5BCD11D-CF53-13E8-21A0-55210FBE13D2} - C:\WINDOWS\cruq.dll (file missing)
O2 - BHO: Class - {E70BCFE8-4567-8803-D4D5-7B3E4E06E85F} - C:\WINDOWS\sdkxs.dll (file missing)
O2 - BHO: Class - {E8D32FF6-E55B-43E7-180C-D9B8824CCF0E} - C:\WINDOWS\system32\sdkmf32.dll (file missing)
O2 - BHO: Class - {F4937205-7DD5-3F45-5AC5-CC5F02C22B1F} - C:\WINDOWS\system32\appep32.dll (file missing)
O2 - BHO: Class - {F4B618B9-0307-3F24-424E-85E6AA513D1B} - C:\WINDOWS\netzk32.dll (file missing)
O2 - BHO: Class - {FA3D5AF1-D568-4BFB-1A26-677DED81D60C} - C:\WINDOWS\system32\sdkaz.dll (file missing)
O2 - BHO: Class - {FC4D1C93-3A3E-35D2-1515-1A241B913EAD} - C:\WINDOWS\msbq.dll (file missing)
O2 - BHO: Class - {FCC802CB-41F0-C6B1-5A49-B5299A5A9413} - C:\WINDOWS\system32\d3km32.dll (file missing)
O2 - BHO: Class - {FFD546EC-FB9C-77B7-E8C5-9C46B980AA6C} - C:\WINDOWS\system32\apptv.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: xtramsn - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\en-nz\msntb.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe
O4 - HKLM\..\Run: [DrvLsnr] C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
O4 - HKLM\..\Run: [SetRefresh] C:\Program Files\Compaq\SetRefresh\SetRefresh.exe
O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [ScanRegistry] C:\W
O4 - HKLM\..\Run: [crsb32.exe] C:\WINDOWS\system32\crsb32.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SunServer] C:\Program Files\Sunbelt Software\CounterSpy\Consumer\sunserver.exe
O4 - HKLM\..\RunOnce: [netmw32.exe] C:\WINDOWS\system32\netmw32.exe
O4 - HKLM\..\RunOnce: [ipme32.exe] C:\WINDOWS\system32\ipme32.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_01\bin\npjpi142_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_01\bin\npjpi142_01.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://xtra.co.nz
O16 - DPF: ppctlcab - http://69.44.122.156/scanner/ppctlcab.cab
O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - http://69.44.122.156/scanner/axscanner.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m…84/mcinsctl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by101fd.bay101.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/m…,21/mcgdmgr.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/asa/SymAData.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B5CADF86-A20D-4114-B981-87C13D6E9AF2}: NameServer = 202.27.158.40 202.27.156.72
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Network Security Service ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\system32\ntdu.exe" /s (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
Post #2
Hello sezza, welcome to the forum. Sorry about the delay in responding :( If you still need help, Scan again with HijackThis, and copy/paste" a new log file into this thread.
Post #3

Hello sezza, welcome to the forum.

Sorry about the delay in responding :(

If you still need help, Scan again with HijackThis, and copy/paste" a new log file into this thread.

thanks for your time - here is the log file!

Regards, sarah
:)
Logfile of HijackThis v1.99.1
Scan saved at 7:04:23 p.m., on 12/10/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Sunbelt Software\CounterSpy\Consumer\sunThreatEngine.exe
C:\Program Files\Sunbelt Software\CounterSpy\Consumer\SunProtectionServer.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe
C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe
C:\Program Files\Alcatel\Dragdiag.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Compaq\Easy Access Button Support\CPQEADM.EXE
C:\Compaq\EAKDRV\EAUSBKBD.EXE
C:\WINDOWS\system32\crsb32.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Sunbelt Software\CounterSpy\Consumer\sunserver.exe
C:\PROGRA~1\Compaq\EASYAC~1\BttnServ.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\WINDOWS\System32\HPZipm12.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Microsoft Office\Office10\OUTLOOK.EXE
C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Documents and Settings\Administrator\Desktop\SpyWare\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\xpgcp.dll/sp.html#83556
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\riadh.dll/sp.html#83556
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\xpgcp.dll/sp.html#83556
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\xpgcp.dll/sp.html#83556
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\xpgcp.dll/sp.html#83556
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\xpgcp.dll/sp.html#83556
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\xpgcp.dll/sp.html#83556
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Class - {093585F1-45A2-F3FD-5DC8-CE8C707B844B} - C:\WINDOWS\ipsy.dll (file missing)
O2 - BHO: Class - {0AE716A6-1EDA-411D-6031-97E7FA0907DD} - C:\WINDOWS\system32\apiyh.dll (file missing)
O2 - BHO: Class - {0B5661F6-E169-C5E2-B4B1-47BCE745AF26} - C:\WINDOWS\system32\atlnw.dll (file missing)
O2 - BHO: Class - {1536ACBD-A373-3F26-8F48-46BE2D830EF0} - C:\WINDOWS\system32\ienx.dll (file missing)
O2 - BHO: Class - {1706490A-46E4-DD57-A8BB-9E0DE0B66E7B} - C:\WINDOWS\crqd32.dll (file missing)
O2 - BHO: Class - {20FBF908-0E40-FE23-831C-A7091EC44CAE} - C:\WINDOWS\system32\addpu.dll (file missing)
O2 - BHO: Class - {24817430-5142-4C7E-9CFF-0DCF7AC3D4C9} - C:\WINDOWS\system32\sysvf32.dll (file missing)
O2 - BHO: Class - {26EB855E-8020-394A-64FD-DB123824DB35} - C:\WINDOWS\javaqf.dll (file missing)
O2 - BHO: Class - {2824CF77-AF01-AB9B-0E03-B55D8EAF18D4} - C:\WINDOWS\d3il32.dll (file missing)
O2 - BHO: Class - {29B4E47E-E6A8-7CE4-67AD-EBB35E41D7C2} - C:\WINDOWS\system32\winbz32.dll (file missing)
O2 - BHO: Class - {2ABA8EC8-43E6-7C24-9568-068569082C70} - C:\WINDOWS\system32\javaes.dll (file missing)
O2 - BHO: Class - {2B7DA50D-14B4-6A84-5DA6-C94EF1A69AAB} - C:\WINDOWS\iehk.dll (file missing)
O2 - BHO: Class - {2FC68BAA-E00A-CB9F-C91B-DCEDFBEFA258} - C:\WINDOWS\apiuw.dll (file missing)
O2 - BHO: Class - {32646C8A-BB54-7D47-C6A8-722B0FA51A6C} - C:\WINDOWS\system32\atlzh32.dll (file missing)
O2 - BHO: Class - {39497903-FC95-F850-8965-3C13F3D7274A} - C:\WINDOWS\system32\winbb.dll (file missing)
O2 - BHO: Class - {3C41D032-236A-13C4-286A-0128CEB6BBEF} - C:\WINDOWS\system32\apism.dll (file missing)
O2 - BHO: Class - {3E634ABC-AA83-3403-5DD5-43546E8735F1} - C:\WINDOWS\system32\sysxg32.dll (file missing)
O2 - BHO: Class - {44FF9B6E-F797-2D86-0148-1DE3BCB54D24} - C:\WINDOWS\netmd.dll (file missing)
O2 - BHO: Class - {4CF3F22B-5DA9-5DE0-5DEB-EE4100912572} - C:\WINDOWS\netiq32.dll (file missing)
O2 - BHO: Class - {4D46E395-B9CE-F003-30B8-9B4EB6EACBD3} - C:\WINDOWS\netns32.dll (file missing)
O2 - BHO: Class - {4E3683EC-EDA1-0338-4DF4-D571699FD262} - C:\WINDOWS\system32\mfcds32.dll (file missing)
O2 - BHO: Class - {524102DB-A22C-9350-6565-DE17AF479294} - C:\WINDOWS\system32\netbu32.dll (file missing)
O2 - BHO: Class - {55F20EFF-2F9C-BDB0-B7CF-8E85DA740089} - C:\WINDOWS\system32\d3pa.dll (file missing)
O2 - BHO: Class - {599586A7-52FB-1A19-3150-DD3446C41F79} - C:\WINDOWS\ntyv.dll (file missing)
O2 - BHO: Class - {5AC5C3B9-9CEC-BC17-DFFB-3F33F50B8236} - C:\WINDOWS\winlb.dll (file missing)
O2 - BHO: Class - {5AD33BA6-7ADF-0FBE-C0F0-7C18C405DE9E} - C:\WINDOWS\netlz32.dll (file missing)
O2 - BHO: Class - {5CD71DC4-F3DB-2684-1DD2-B8F55F150CDE} - C:\WINDOWS\system32\ipni32.dll (file missing)
O2 - BHO: Class - {5E5E70C2-E430-0AAF-8ECE-321F9B1C4F50} - C:\WINDOWS\system32\msdz.dll (file missing)
O2 - BHO: Class - {5EB8144B-6EF2-7346-72E4-ADB028205C5E} - C:\WINDOWS\system32\netks32.dll (file missing)
O2 - BHO: Class - {64CDF8EE-8744-A3BF-4F77-0ADBBEE622A8} - C:\WINDOWS\system32\apiwx.dll (file missing)
O2 - BHO: Class - {6763EDCB-2C49-F4B4-713C-E8F6A5E7D81E} - C:\WINDOWS\winfm.dll (file missing)
O2 - BHO: Class - {69535ABC-0AE9-CD1D-1A43-88C6797D9B6E} - C:\WINDOWS\addrv.dll (file missing)
O2 - BHO: Class - {6B2B1D4A-827F-5433-DF52-88CA090883DD} - C:\WINDOWS\system32\d3gf32.dll (file missing)
O2 - BHO: Class - {6C2A592C-2CEB-91F6-ABFC-8A6CAA196309} - C:\WINDOWS\d3mw32.dll (file missing)
O2 - BHO: Class - {6D33AC15-1E7C-6792-3A0F-7F24E39ABC19} - C:\WINDOWS\syszq32.dll (file missing)
O2 - BHO: Class - {6E211685-27D7-C653-853B-75B6D59AC151} - C:\WINDOWS\system32\apphb.dll (file missing)
O2 - BHO: Class - {6F75ABBF-6008-EDA7-8453-2ADF8601ADFA} - C:\WINDOWS\msof32.dll (file missing)
O2 - BHO: Class - {713B605D-71E8-169E-A30F-39C4603AF036} - C:\WINDOWS\system32\javaou32.dll (file missing)
O2 - BHO: Class - {75AB9EE4-0E8F-7F96-4A65-7E768261D1CA} - C:\WINDOWS\system32\iefb.dll (file missing)
O2 - BHO: Class - {7E678766-5C45-3E67-EFD2-B3449A8C2A69} - C:\WINDOWS\winnk.dll (file missing)
O2 - BHO: Class - {820EE400-4068-7AC4-7934-F519A5AC7D69} - C:\WINDOWS\system32\sdkwo.dll (file missing)
O2 - BHO: Class - {866A3A28-5F61-83BA-C3CA-AA1516A9ABFB} - C:\WINDOWS\atlbi32.dll (file missing)
O2 - BHO: Class - {868B9A8E-F8FF-0CE7-B336-2B1AF1713C5F} - C:\WINDOWS\addvi32.dll (file missing)
O2 - BHO: Class - {8757DCF3-EDCB-AF1D-2A96-1BA99BF8F486} - C:\WINDOWS\sdkyy.dll (file missing)
O2 - BHO: Class - {883EDD1C-FC42-B1BC-75A1-920AD1D28523} - C:\WINDOWS\addrx32.dll (file missing)
O2 - BHO: Class - {8B82102E-F491-66D2-F758-5BB004FEE44C} - C:\WINDOWS\windd.dll (file missing)
O2 - BHO: Class - {906797F2-8B34-E847-8C8D-3155F09D9D9E} - C:\WINDOWS\netof.dll (file missing)
O2 - BHO: Class - {92A72092-878E-DBA3-15F0-ADF6FD6C738B} - C:\WINDOWS\appxs32.dll (file missing)
O2 - BHO: Class - {97E69A69-394F-FEBB-02E2-194D4BE08C63} - C:\WINDOWS\ipej32.dll (file missing)
O2 - BHO: Class - {983F54F7-9CFC-69CC-4991-DEFEE8A65CCE} - C:\WINDOWS\addcp.dll (file missing)
O2 - BHO: Class - {9A931858-10E5-A8C8-DEAB-9C22D8F760CE} - C:\WINDOWS\atlxx.dll (file missing)
O2 - BHO: Class - {A16A74CA-2FA4-7746-A5FB-F309CC45452C} - C:\WINDOWS\system32\applm.dll (file missing)
O2 - BHO: Class - {A40065FF-BD8D-CBD6-9113-F234816A3EC3} - C:\WINDOWS\system32\crsh.dll (file missing)
O2 - BHO: Class - {A4AD1BD7-C167-5175-E4ED-1A49E67AE91E} - C:\WINDOWS\javacj.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Class - {B043489C-6BF0-01EB-E5BD-CE306F545707} - C:\WINDOWS\system32\ieju.dll (file missing)
O2 - BHO: Class - {B35E41D7-21EB-4FC8-369F-8EDCA0E710E9} - C:\WINDOWS\ntkd32.dll (file missing)
O2 - BHO: Class - {B36A4008-5663-2ECF-9E70-FA3F4CC8F486} - C:\WINDOWS\mfcqd.dll (file missing)
O2 - BHO: Class - {B5C669AE-EA19-B1C5-01F0-6512716B3157} - C:\WINDOWS\system32\ipuz.dll (file missing)
O2 - BHO: Class - {B83AC734-1261-571F-007C-D7C45405AF82} - C:\WINDOWS\system32\ntiu32.dll (file missing)
O2 - BHO: Class - {BDA708A5-8020-F30C-6759-546F47B30DFD} - C:\WINDOWS\appjd.dll (file missing)
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: Class - {C199CC42-9314-C988-794C-4F514B66252B} - C:\WINDOWS\system32\msrg32.dll (file missing)
O2 - BHO: Class - {CBE5A8A2-4CC5-4DF2-2929-3684A8D4A515} - C:\WINDOWS\system32\winpo32.dll (file missing)
O2 - BHO: Class - {D0092D6F-9A27-013B-CDD5-2A7FC6907D07} - C:\WINDOWS\system32\mfcgb32.dll (file missing)
O2 - BHO: Class - {D5803A75-94E4-D765-5CDA-5E6515E89C3E} - C:\WINDOWS\system32\apixj32.dll (file missing)
O2 - BHO: Class - {D741F288-69CD-DC65-04EF-24D24A69D9CD} - C:\WINDOWS\system32\addbk.dll (file missing)
O2 - BHO: Class - {D826F49A-10DC-6D1F-DF97-5115D71C2FF9} - C:\WINDOWS\system32\addth32.dll (file missing)
O2 - BHO: Class - {DB34B7F0-D490-5205-7CAE-49DCC4F42315} - C:\WINDOWS\ntgk32.dll (file missing)
O2 - BHO: Class - {DDF6B14C-567D-8D1E-21D4-2CACE1295ABB} - C:\WINDOWS\systv32.dll (file missing)
O2 - BHO: Class - {DFBFB007-0C50-3E65-C735-D84AD307C759} - C:\WINDOWS\system32\d3yb.dll (file missing)
O2 - BHO: Class - {E2F0712F-9E43-CF54-86D0-C0E27572FBE1} - C:\WINDOWS\system32\crte32.dll (file missing)
O2 - BHO: Class - {E4E213AC-6EE7-E7FD-1EB7-48256674F698} - C:\WINDOWS\system32\ipqo.dll (file missing)
O2 - BHO: Class - {E5BCD11D-CF53-13E8-21A0-55210FBE13D2} - C:\WINDOWS\cruq.dll (file missing)
O2 - BHO: Class - {E70BCFE8-4567-8803-D4D5-7B3E4E06E85F} - C:\WINDOWS\sdkxs.dll (file missing)
O2 - BHO: Class - {E8D32FF6-E55B-43E7-180C-D9B8824CCF0E} - C:\WINDOWS\system32\sdkmf32.dll (file missing)
O2 - BHO: Class - {F4937205-7DD5-3F45-5AC5-CC5F02C22B1F} - C:\WINDOWS\system32\appep32.dll (file missing)
O2 - BHO: Class - {F4B618B9-0307-3F24-424E-85E6AA513D1B} - C:\WINDOWS\netzk32.dll (file missing)
O2 - BHO: Class - {FA3D5AF1-D568-4BFB-1A26-677DED81D60C} - C:\WINDOWS\system32\sdkaz.dll (file missing)
O2 - BHO: Class - {FC4D1C93-3A3E-35D2-1515-1A241B913EAD} - C:\WINDOWS\msbq.dll (file missing)
O2 - BHO: Class - {FCC802CB-41F0-C6B1-5A49-B5299A5A9413} - C:\WINDOWS\system32\d3km32.dll (file missing)
O2 - BHO: Class - {FFD546EC-FB9C-77B7-E8C5-9C46B980AA6C} - C:\WINDOWS\system32\apptv.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: xtramsn - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\en-nz\msntb.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe
O4 - HKLM\..\Run: [DrvLsnr] C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
O4 - HKLM\..\Run: [SetRefresh] C:\Program Files\Compaq\SetRefresh\SetRefresh.exe
O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [ScanRegistry] C:\W
O4 - HKLM\..\Run: [crsb32.exe] C:\WINDOWS\system32\crsb32.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SunServer] C:\Program Files\Sunbelt Software\CounterSpy\Consumer\sunserver.exe
O4 - HKLM\..\RunOnce: [sysgq.exe] C:\WINDOWS\system32\sysgq.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_01\bin\npjpi142_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_01\bin\npjpi142_01.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://xtra.co.nz
O16 - DPF: ppctlcab - http://69.44.122.156/scanner/ppctlcab.cab
O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - http://69.44.122.156/scanner/axscanner.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m…84/mcinsctl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by101fd.bay101.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/m…,21/mcgdmgr.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/asa/SymAData.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B5CADF86-A20D-4114-B981-87C13D6E9AF2}: NameServer = 202.27.158.40 202.27.156.72
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Network Security Service ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\system32\ntdu.exe" /s (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
Post #4
Download CW-Shredder at the link below: (don't run it yet)
http://www.trendmicro.com/ftp/products/onl…/cwshredder.exe

Download 'SpSeHjfix'. into a folder. (don't run it yet)

Clean out temporary and TIF files. Go to Start > Run and type in the box: cleanmgr. Let it scan your system for files to remove. Make sure these 3 are checked and then press *ok* to remove:

Temporary Files
Temporary Internet Files
Recycle Bin


Make sure you know how to boot into - SafeMode

Reboot into safe mode.

Disconnect from the net and Close ALL OPEN PROGRAMS.
Run 'SpSeHjfix'. and click on "Start Disinfection".
When it's finished it will reboot your machine to finish the cleaning process.
The tool creates a log of the fix which will appear in the folder.

Now run the Shredder - Hit The FIX button!

Reboot and repeat the process above starting with Reboot in Safe Mode.

Reboot and post a fresh HJT log and the log that was created by 'SpSeHjfix'.



run it in safe mode and run it twice
Post #5
Thanks for advice - have done so but found that SpSeHjfix didn't reboot the computer after disinfecting - so not sure if it did what it was supposed to do. Anyway - have attached in logs as requested

sarah <_<


(10/13/05 11:09:12 a.m.) SPSeHjFix started v1.1.2
(10/13/05 11:09:12 a.m.) OS: WinXP Service Pack 2 (5.1.2600)
(10/13/05 11:09:12 a.m.) Language: english
(10/13/05 11:09:12 a.m.) Win-Path: C:\WINDOWS
(10/13/05 11:09:12 a.m.) System-Path: C:\WINDOWS\system32
(10/13/05 11:09:12 a.m.) Temp-Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\
(10/13/05 11:09:14 a.m.) Disinfection started
(10/13/05 11:09:14 a.m.) Bad-Dll(IEP): c:\windows\xpgcp.dll
(10/13/05 11:09:14 a.m.) UBF: 7 - UBB: 82 - UBR: 15
(10/13/05 11:09:14 a.m.) UBF: 7 - UBB: 82 - UBR: 15
(10/13/05 11:09:14 a.m.) Bad IE-pages:
deleted: HKCU\Software\Microsoft\Internet Explorer\Main, Search Bar: res://c:\windows\xpgcp.dll/sp.html#83556
deleted: HKCU\Software\Microsoft\Internet Explorer\Main, Start Page: about:blank
deleted: HKCU\Software\Microsoft\Internet Explorer\Search, SearchAssistant: res://c:\windows\xpgcp.dll/sp.html#83556
deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Search Bar: res://c:\windows\xpgcp.dll/sp.html#83556
deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Search Page: res://c:\windows\xpgcp.dll/sp.html#83556
deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Start Page: about:blank
deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Default_Page_URL: about:blank
deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Default_Search_URL: res://c:\windows\xpgcp.dll/sp.html#83556
deleted: HKLM\Software\Microsoft\Internet Explorer\Search, SearchAssistant: res://c:\windows\xpgcp.dll/sp.html#83556
(10/13/05 11:09:14 a.m.) Stealth-String not found
(10/13/05 11:09:14 a.m.) No locked Files to delete. End without Reboot
(10/13/05 11:11:02 a.m.) Disinfection started
(10/13/05 11:11:02 a.m.) Bad-Dll(IEP): c:\windows\riadh.dll
(10/13/05 11:11:02 a.m.) UBF: 7 - UBB: 82 - UBR: 15
(10/13/05 11:11:02 a.m.) UBF: 7 - UBB: 82 - UBR: 15
(10/13/05 11:11:02 a.m.) Bad IE-pages:
deleted: HKCU\Software\Microsoft\Internet Explorer\Main, Search Page: res://c:\windows\riadh.dll/sp.html#83556
(10/13/05 11:11:02 a.m.) Stealth-String not found
(10/13/05 11:11:02 a.m.) No locked Files to delete. End without Reboot
(10/13/05 11:11:19 a.m.) Disinfection started
(10/13/05 11:11:19 a.m.) Bad-Dll(IEP): c:\windows\riadh.dll
(10/13/05 11:11:19 a.m.) UBF: 7 - UBB: 82 - UBR: 15
(10/13/05 11:11:19 a.m.) UBF: 7 - UBB: 82 - UBR: 15
(10/13/05 11:11:19 a.m.) Bad IE-pages: (none)
(10/13/05 11:11:19 a.m.) Stealth-String not found
(10/13/05 11:11:19 a.m.) No locked Files to delete. End without Reboot
(10/13/05 11:11:25 a.m.) Disinfection started
(10/13/05 11:11:25 a.m.) Bad-Dll(IEP): c:\windows\riadh.dll
(10/13/05 11:11:25 a.m.) UBF: 7 - UBB: 82 - UBR: 15
(10/13/05 11:11:25 a.m.) UBF: 7 - UBB: 82 - UBR: 15
(10/13/05 11:11:25 a.m.) Bad IE-pages: (none)
(10/13/05 11:11:25 a.m.) Stealth-String not found
(10/13/05 11:11:25 a.m.) No locked Files to delete. End without Reboot
(10/13/05 11:11:25 a.m.) Disinfection started
(10/13/05 11:11:25 a.m.) Bad-Dll(IEP): c:\windows\riadh.dll
(10/13/05 11:11:25 a.m.) UBF: 7 - UBB: 82 - UBR: 15
(10/13/05 11:11:25 a.m.) UBF: 7 - UBB: 82 - UBR: 15
(10/13/05 11:11:25 a.m.) Bad IE-pages: (none)
(10/13/05 11:11:25 a.m.) Stealth-String not found
(10/13/05 11:11:25 a.m.) No locked Files to delete. End without Reboot
(10/13/05 11:11:44 a.m.) Disinfection started
(10/13/05 11:11:44 a.m.) Bad-Dll(IEP): c:\windows\riadh.dll
(10/13/05 11:11:44 a.m.) UBF: 7 - UBB: 82 - UBR: 15
(10/13/05 11:11:44 a.m.) UBF: 7 - UBB: 82 - UBR: 15
(10/13/05 11:11:44 a.m.) Bad IE-pages: (none)
(10/13/05 11:11:44 a.m.) Stealth-String not found
(10/13/05 11:11:44 a.m.) No locked Files to delete. End without Reboot
(10/13/05 11:11:45 a.m.) Disinfection started
(10/13/05 11:11:45 a.m.) Bad-Dll(IEP): c:\windows\riadh.dll
(10/13/05 11:11:45 a.m.) UBF: 7 - UBB: 82 - UBR: 15
(10/13/05 11:11:45 a.m.) UBF: 7 - UBB: 82 - UBR: 15
(10/13/05 11:11:45 a.m.) Bad IE-pages: (none)
(10/13/05 11:11:45 a.m.) Stealth-String not found
(10/13/05 11:11:45 a.m.) No locked Files to delete. End without Reboot
(10/13/05 11:11:55 a.m.) Disinfection started
(10/13/05 11:11:55 a.m.) Bad-Dll(IEP): c:\windows\riadh.dll
(10/13/05 11:11:55 a.m.) UBF: 7 - UBB: 82 - UBR: 15
(10/13/05 11:11:55 a.m.) UBF: 7 - UBB: 82 - UBR: 15
(10/13/05 11:11:55 a.m.) Bad IE-pages: (none)
(10/13/05 11:11:55 a.m.) Stealth-String not found
(10/13/05 11:11:55 a.m.) No locked Files to delete. End without Reboot
(10/13/05 11:11:56 a.m.) Disinfection started
(10/13/05 11:11:56 a.m.) Bad-Dll(IEP): c:\windows\riadh.dll
(10/13/05 11:11:56 a.m.) UBF: 7 - UBB: 82 - UBR: 15
(10/13/05 11:11:56 a.m.) UBF: 7 - UBB: 82 - UBR: 15
(10/13/05 11:11:56 a.m.) Bad IE-pages: (none)
(10/13/05 11:11:56 a.m.) Stealth-String not found
(10/13/05 11:11:56 a.m.) No locked Files to delete. End without Reboot


(10/13/05 11:12:00 a.m.) SPSeHjFix started v1.1.2
(10/13/05 11:12:00 a.m.) OS: WinXP Service Pack 2 (5.1.2600)
(10/13/05 11:12:00 a.m.) Language: english
(10/13/05 11:12:00 a.m.) Win-Path: C:\WINDOWS
(10/13/05 11:12:00 a.m.) System-Path: C:\WINDOWS\system32
(10/13/05 11:12:00 a.m.) Temp-Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\
(10/13/05 11:12:02 a.m.) Disinfection started
(10/13/05 11:12:02 a.m.) Bad-Dll(IEP): (not found)
(10/13/05 11:12:02 a.m.) Bad-Dll(IEP) in BHO: (not found)
(10/13/05 11:12:02 a.m.) UBF: 7 - UBB: 82 - UBR: 15
(10/13/05 11:12:02 a.m.) UBF: 7 - UBB: 82 - UBR: 15
(10/13/05 11:12:02 a.m.) Bad IE-pages: (none)
(10/13/05 11:12:02 a.m.) Stealth-String not found
(10/13/05 11:12:02 a.m.) Not infected->END


(10/13/05 9:19:06 p.m.) SPSeHjFix started v1.1.2
(10/13/05 9:19:06 p.m.) OS: WinXP Service Pack 2 (5.1.2600)
(10/13/05 9:19:06 p.m.) Language: english
(10/13/05 9:19:06 p.m.) Win-Path: C:\WINDOWS
(10/13/05 9:19:06 p.m.) System-Path: C:\WINDOWS\system32
(10/13/05 9:19:06 p.m.) Temp-Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\
(10/13/05 9:19:09 p.m.) Disinfection started
(10/13/05 9:19:09 p.m.) Bad-Dll(IEP): (not found)
(10/13/05 9:19:09 p.m.) Bad-Dll(IEP) in BHO: (not found)
(10/13/05 9:19:09 p.m.) UBF: 7 - UBB: 82 - UBR: 15
(10/13/05 9:19:09 p.m.) UBF: 7 - UBB: 82 - UBR: 15
(10/13/05 9:19:09 p.m.) Bad IE-pages: (none)
(10/13/05 9:19:09 p.m.) Stealth-String not found
(10/13/05 9:19:09 p.m.) Not infected->END


(10/13/05 9:19:51 p.m.) SPSeHjFix started v1.1.2
(10/13/05 9:19:51 p.m.) OS: WinXP Service Pack 2 (5.1.2600)
(10/13/05 9:19:51 p.m.) Language: english
(10/13/05 9:19:51 p.m.) Win-Path: C:\WINDOWS
(10/13/05 9:19:51 p.m.) System-Path: C:\WINDOWS\system32
(10/13/05 9:19:51 p.m.) Temp-Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\


(10/13/05 9:27:02 p.m.) SPSeHjFix started v1.1.2
(10/13/05 9:27:02 p.m.) OS: WinXP Service Pack 2 (5.1.2600)
(10/13/05 9:27:02 p.m.) Language: english
(10/13/05 9:27:02 p.m.) Win-Path: C:\WINDOWS
(10/13/05 9:27:02 p.m.) System-Path: C:\WINDOWS\system32
(10/13/05 9:27:02 p.m.) Temp-Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\
(10/13/05 9:27:05 p.m.) Disinfection started
(10/13/05 9:27:05 p.m.) Bad-Dll(IEP): (not found)
(10/13/05 9:27:05 p.m.) Bad-Dll(IEP) in BHO: (not found)
(10/13/05 9:27:05 p.m.) UBF: 7 - UBB: 21 - UBR: 12
(10/13/05 9:27:05 p.m.) UBF: 7 - UBB: 21 - UBR: 12
(10/13/05 9:27:05 p.m.) Bad IE-pages: (none)
(10/13/05 9:27:05 p.m.) Stealth-String not found
(10/13/05 9:27:05 p.m.) Not infected->END


Logfile of HijackThis v1.99.1
Scan saved at 9:35:18 p.m., on 13/10/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Sunbelt Software\CounterSpy\Consumer\sunThreatEngine.exe
C:\Program Files\Sunbelt Software\CounterSpy\Consumer\SunProtectionServer.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe
C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe
C:\Program Files\Alcatel\Dragdiag.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Compaq\Easy Access Button Support\CPQEADM.EXE
C:\Compaq\EAKDRV\EAUSBKBD.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Sunbelt Software\CounterSpy\Consumer\sunserver.exe
C:\PROGRA~1\Compaq\EASYAC~1\BttnServ.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Microsoft Office\Office10\OUTLOOK.EXE
C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\Norton Internet Security\Norton AntiVirus\OPScan.exe
C:\Documents and Settings\Administrator\Desktop\SpyWare\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Class - {1536ACBD-A373-3F26-8F48-46BE2D830EF0} - C:\WINDOWS\system32\ienx.dll (file missing)
O2 - BHO: Class - {26EB855E-8020-394A-64FD-DB123824DB35} - C:\WINDOWS\javaqf.dll (file missing)
O2 - BHO: Class - {2B7DA50D-14B4-6A84-5DA6-C94EF1A69AAB} - C:\WINDOWS\iehk.dll (file missing)
O2 - BHO: Class - {3C41D032-236A-13C4-286A-0128CEB6BBEF} - C:\WINDOWS\system32\apism.dll (file missing)
O2 - BHO: Class - {4D46E395-B9CE-F003-30B8-9B4EB6EACBD3} - C:\WINDOWS\netns32.dll (file missing)
O2 - BHO: Class - {599586A7-52FB-1A19-3150-DD3446C41F79} - C:\WINDOWS\ntyv.dll (file missing)
O2 - BHO: Class - {5E5E70C2-E430-0AAF-8ECE-321F9B1C4F50} - C:\WINDOWS\system32\msdz.dll (file missing)
O2 - BHO: Class - {69535ABC-0AE9-CD1D-1A43-88C6797D9B6E} - C:\WINDOWS\addrv.dll (file missing)
O2 - BHO: Class - {6E211685-27D7-C653-853B-75B6D59AC151} - C:\WINDOWS\system32\apphb.dll (file missing)
O2 - BHO: Class - {7E678766-5C45-3E67-EFD2-B3449A8C2A69} - C:\WINDOWS\winnk.dll (file missing)
O2 - BHO: Class - {8757DCF3-EDCB-AF1D-2A96-1BA99BF8F486} - C:\WINDOWS\sdkyy.dll (file missing)
O2 - BHO: Class - {92A72092-878E-DBA3-15F0-ADF6FD6C738B} - C:\WINDOWS\appxs32.dll (file missing)
O2 - BHO: Class - {A16A74CA-2FA4-7746-A5FB-F309CC45452C} - C:\WINDOWS\system32\applm.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Class - {B5C669AE-EA19-B1C5-01F0-6512716B3157} - C:\WINDOWS\system32\ipuz.dll (file missing)
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: Class - {D5803A75-94E4-D765-5CDA-5E6515E89C3E} - C:\WINDOWS\system32\apixj32.dll (file missing)
O2 - BHO: Class - {DDF6B14C-567D-8D1E-21D4-2CACE1295ABB} - C:\WINDOWS\systv32.dll (file missing)
O2 - BHO: Class - {E5BCD11D-CF53-13E8-21A0-55210FBE13D2} - C:\WINDOWS\cruq.dll (file missing)
O2 - BHO: Class - {F4B618B9-0307-3F24-424E-85E6AA513D1B} - C:\WINDOWS\netzk32.dll (file missing)
O2 - BHO: Class - {FFD546EC-FB9C-77B7-E8C5-9C46B980AA6C} - C:\WINDOWS\system32\apptv.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: xtramsn - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\en-nz\msntb.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe
O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [ScanRegistry] C:\W
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SunServer] C:\Program Files\Sunbelt Software\CounterSpy\Consumer\sunserver.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_01\bin\npjpi142_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_01\bin\npjpi142_01.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://xtra.co.nz
O16 - DPF: ppctlcab - http://69.44.122.156/scanner/ppctlcab.cab
O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - http://69.44.122.156/scanner/axscanner.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m…84/mcinsctl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by101fd.bay101.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/m…,21/mcgdmgr.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/asa/SymAData.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B5CADF86-A20D-4114-B981-87C13D6E9AF2}: NameServer = 202.27.158.40 202.27.156.72
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
Post #6
I suggest you do this:

Run hijackthis. Hit None of the above, Click Do a System Scan Only. Put a Check in the box on the left side on these:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R3 - Default URLSearchHook is missing

- BHO: Class - {1536ACBD-A373-3F26-8F48-46BE2D830EF0} - C:\WINDOWS\system32\ienx.dll (file missing)

O2 - BHO: Class - {26EB855E-8020-394A-64FD-DB123824DB35} - C:\WINDOWS\javaqf.dll (file missing)

O2 - BHO: Class - {2B7DA50D-14B4-6A84-5DA6-C94EF1A69AAB} - C:\WINDOWS\iehk.dll (file missing)

O2 - BHO: Class - {3C41D032-236A-13C4-286A-0128CEB6BBEF} - C:\WINDOWS\system32\apism.dll (file missing)

O2 - BHO: Class - {4D46E395-B9CE-F003-30B8-9B4EB6EACBD3} - C:\WINDOWS\netns32.dll (file missing)

O2 - BHO: Class - {599586A7-52FB-1A19-3150-DD3446C41F79} - C:\WINDOWS\ntyv.dll (file missing)

O2 - BHO: Class - {5E5E70C2-E430-0AAF-8ECE-321F9B1C4F50} - C:\WINDOWS\system32\msdz.dll (file missing)

O2 - BHO: Class - {69535ABC-0AE9-CD1D-1A43-88C6797D9B6E} - C:\WINDOWS\addrv.dll (file missing)

O2 - BHO: Class - {6E211685-27D7-C653-853B-75B6D59AC151} - C:\WINDOWS\system32\apphb.dll (file missing)

O2 - BHO: Class - {7E678766-5C45-3E67-EFD2-B3449A8C2A69} - C:\WINDOWS\winnk.dll (file missing)

O2 - BHO: Class - {8757DCF3-EDCB-AF1D-2A96-1BA99BF8F486} - C:\WINDOWS\sdkyy.dll (file missing)

O2 - BHO: Class - {92A72092-878E-DBA3-15F0-ADF6FD6C738B} - C:\WINDOWS\appxs32.dll (file missing)

O2 - BHO: Class - {A16A74CA-2FA4-7746-A5FB-F309CC45452C} - C:\WINDOWS\system32\applm.dll (file missing)

O2 - BHO: Class - {B5C669AE-EA19-B1C5-01F0-6512716B3157} - C:\WINDOWS\system32\ipuz.dll (file missing)

O2 - BHO: Class - {D5803A75-94E4-D765-5CDA-5E6515E89C3E} - C:\WINDOWS\system32\apixj32.dll (file missing)

O2 - BHO: Class - {DDF6B14C-567D-8D1E-21D4-2CACE1295ABB} - C:\WINDOWS\systv32.dll (file missing)

O2 - BHO: Class - {E5BCD11D-CF53-13E8-21A0-55210FBE13D2} - C:\WINDOWS\cruq.dll (file missing)

O2 - BHO: Class - {F4B618B9-0307-3F24-424E-85E6AA513D1B} - C:\WINDOWS\netzk32.dll (file missing)

O2 - BHO: Class - {FFD546EC-FB9C-77B7-E8C5-9C46B980AA6C} - C:\WINDOWS\system32\apptv.dll (file missing)

O4 - HKLM\..\Run: [ScanRegistry] C:\W

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

Close ALL windows and browsers except HijackThis and click "Fix checked"



Restart in Safe Mode:
Restart your computer.

Press F8 after the Power-On Self Test (POST) is done. If the Windows Advanced Options Menu does not appear, try restarting and then pressing F8 several times after the POST screen.
Choose the Safe Mode option from the Windows Advanced Options Menu then press Enter.


Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Clear "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Clear "Hide protected operating system files."
Click Apply, and then click OK.

Open C:\Windows\Prefetch\ Delete ALL files in this folder.



Do this also if these Temp Folders are part of your OS.

Also in safe mode navigate to the C:\Windows\Temp folder. Open the Temp folder and go to Edit > Select All then Edit > Delete to delete the entire contents of the Temp folder.


Next navigate to the C:\Documents and Settings\(EVERY LISTED USER)\Local Settings\Temp folder. Open the Temp folder and go to Edit > Select All then Edit > Delete to delete the entire contents of the Temp folder.

Finally go to Control Panel > Internet Options. On the General tab under "Temporary Internet Files" Click "Delete Files". Put a check by "Delete Offline Content" and click OK. Click on the Programs tab then click the "Reset Web Settings" button. Click Apply then OK.


Empty the Recycle Bin

Reboot and "copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at the moment.
Post #7
Think you may have gotten rid of the spyware! Have run four scans and the last two came up free from all spyware (counterspy)

Otherwise the computer seems to be running fine!

I don't know whether i would be jinxing myself now if I said thank you!!!!

Sarah :lol:

Logfile of HijackThis v1.99.1
Scan saved at 2:38:10 p.m., on 14/10/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Sunbelt Software\CounterSpy\Consumer\sunThreatEngine.exe
C:\Program Files\Sunbelt Software\CounterSpy\Consumer\SunProtectionServer.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe
C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe
C:\Program Files\Alcatel\Dragdiag.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Sunbelt Software\CounterSpy\Consumer\sunserver.exe
C:\Program Files\Compaq\Easy Access Button Support\CPQEADM.EXE
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Compaq\EAKDRV\EAUSBKBD.EXE
C:\PROGRA~1\Compaq\EASYAC~1\BttnServ.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Administrator\Desktop\SpyWare\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://xtra.co.nz
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://xtra.co.nz
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: xtramsn - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\en-nz\msntb.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe
O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SunServer] C:\Program Files\Sunbelt Software\CounterSpy\Consumer\sunserver.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_01\bin\npjpi142_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_01\bin\npjpi142_01.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://xtra.co.nz
O16 - DPF: ppctlcab - http://69.44.122.156/scanner/ppctlcab.cab
O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - http://69.44.122.156/scanner/axscanner.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m…84/mcinsctl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by101fd.bay101.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/m…,21/mcgdmgr.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/asa/SymAData.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
Post #8
Good Job :thumbup:


Log looks good :D :thumbup: How is it running any issues?

Note: This will remove all previous Restore Points

Turn off System Restore:

On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.

Restart your computer, turn it back on.

On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Remove the Check Turn off System Restore.
Click Apply, and then click OK.

Click Start> My Computer, select the Tools menu and then Folder Options, after the new window appears select the View tab…]
This time select the: Restore Defaults
Select: Apply, and click OK




If you dont have these three programs I would recommend that you get them. Spywareblaster, Spywareguard and IESPY AD. They will add 1000's of sites to your resticted zone and block some hijacks from happening. I also have a FREE FIREWALL and FREE ANTI VIRUS if you need one.

It is critical to have both a firewall and anti virus to protect your system.

Keep your system up to date and run Adaware & Spybot, once a week works, and hopefully you will be ok from here on. Both are available below.

Safe Surfing. :D
Post #9
Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI