What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Reposted log

18 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hello all
I hope someone will be able to help
I posted this earlier but rather hurriedly so did not go through the niceties, for which apologies.

My machine got mugged yesterday when (I think) I turned off a firewall briefly to speed up a page refresh. I promptly forgot to turn the firewall on again. I believe that's when it happened.

It runs on XP no service packs I don't think (log will tell?)

Explorer won't get past a screen with some sort of "search" button on it.
My wallpaper was replaced with a bluescreen message about smit-wurm (I did not copy exact text) There is also now some weird icon in the system tray telling me the machine is infected, but it's not the SpywareDoctor icon as far as I can tell. Occasionally the icon sprouts a bubble saying "Your computer is infected click here blah-blah-blah".

My Compuserve software (quite an old version) will start, but the CServe software closes down as soon as I make a connection to Compuserve e.g. to pick up mail. I can access mail through POP so no problem, except I can foresee a horrendous CServe bill looming.

Netscape 8 works OK, which is what I'm using here.

I have used HJT in the past and it fixed one or two problems very neatly, but I'm essentially a newcomer. So here's the log anyway, and over to anyone who can provide valuable and much appreciated help
Thanks
Dan

Logfile of HijackThis v1.99.1
Scan saved at 00:21:47, on 28/10/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\WINDOWS\System32\CTSVCCD.EXE
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Creative\SB Live! 24-bit\Surround Mixer\CTSysVol.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\WINDOWS\System32\rundll32.exe
C:\WINDOWS\System32\intel32.exe
C:\WINDOWS\System32\icasServ.exe
C:\WINDOWS\System32\vmlib.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Tiscali\tkonnect\tkonnect.exe
C:\Program Files\BigFix\BigFix.exe
C:\WINDOWS\DvzCommon\DvzMsgr.exe
C:\Program Files\Hewlett-Packard\AiO\hp psc 900 series\Bin\hpobrt07.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\Palm\HOTSYNC.EXE
C:\WINDOWS\System32\rundll32.exe
C:\WINDOWS\System32\msdtc.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\sysmanager.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\system32\fxssvc.exe
C:\PROGRA~1\HEWLET~1\AiO\Shared\Bin\hpoevm07.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\WINDOWS\sllights.exe
C:\Program Files\Hewlett-Packard\AiO\Shared\bin\hpOSTS07.exe
C:\Program Files\Hewlett-Packard\AiO\Shared\bin\hpOFXM07.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\DOCUME~1\FONTAN~1\LOCALS~1\Temp\Netscape Installer\87\nsb-install-8-0.exe
C:\Program Files\Netscape\Netscape Browser\flash-ns.exe
C:\WINDOWS\System32\taskmgr.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Netscape\Communicator\Program\netscape.exe
C:\Program Files\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:NavigationFailure
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:NavigationFailure
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.red.clientapps.yahoo.com/customi…arch.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.windowsmedia.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_17_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O2 - BHO: (no name) - {D3AE36A1-4012-479A-9EE6-1709A0068F0F} - C:\WINDOWS\System32\cmog.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: BT Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_17_0.dll
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Probe\AsusProb.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\BTYAHO~1\Help\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [M_S DVD DirectX Dll Drivers] msxdl.exe
O4 - HKLM\..\Run: [CT Control Settings] CTSVCCD.EXE
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [AsioReg] REGSVR32 /S CTASIO.DLL
O4 - HKLM\..\Run: [DevconDefaultDB] C:\WINDOWS\READREG /PSCONV={NO}
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SB Live! 24-bit\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [sp] rundll32 C:\DOCUME~1\FONTAN~1\LOCALS~1\Temp\se.dll,DllInstall
O4 - HKLM\..\Run: [intel32.exe] C:\WINDOWS\System32\intel32.exe
O4 - HKLM\..\Run: [icasServ] C:\WINDOWS\System32\icasServ.exe
O4 - HKLM\..\Run: [vmlib] vmlib.exe
O4 - HKLM\..\Run: [P.S.Guard] C:\Program Files\P.S.Guard\PSGuard.exe
O4 - HKLM\..\RunServices: [M_S DVD DirectX Dll Drivers] msxdl.exe
O4 - HKLM\..\RunServices: [CT Control Settings] CTSVCCD.EXE
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [M_S DVD DirectX Dll Drivers] msxdl.exe
O4 - HKCU\..\Run: [tkonnect] C:\Program Files\Tiscali\tkonnect\tkonnect.exe updatemode
O4 - HKCU\..\Run: [CT Control Settings] CTSVCCD.EXE
O4 - HKCU\..\Run: [SetDefaultMIDI] MIDIDef.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [aupd] C:\WINDOWS\System32\sysvcs.exe
O4 - HKCU\..\RunServices: [M_S DVD DirectX Dll Drivers] msxdl.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\BigFix.exe
O4 - Global Startup: DataViz Messenger.lnk = C:\WINDOWS\DvzCommon\DvzMsgr.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: BT Yahoo! Sidebar - {51085E3D-A958-42A2-A6BE-A6A9B0BAF276} - C:\Program Files\Yahoo!\browser\ysidebarIE.dll
O9 - Extra 'Tools' menuitem: BT &Yahoo! Sidebar - {51085E3D-A958-42A2-A6BE-A6A9B0BAF276} - C:\Program Files\Yahoo!\browser\ysidebarIE.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O12 - Plugin for .avi: C:\Program Files\Netscape\Communicator\Program\PLUGINS\npavi32.dll
O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .pdf: C:\Program Files\Netscape\Communicator\Program\PLUGINS\nppdf32.dll
O16 - DPF: {231B1C6E-F934-42A2-92B6-C2FEFEC24276} (yucsetreg Class) - C:\Program Files\Yahoo!\common\yucconfig.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\common\yinsthelper.dll
O18 - Filter: text/html - {12873269-74E2-405C-B587-C438A14F31E6} - C:\WINDOWS\System32\cmog.dll
O18 - Filter: text/plain - {12873269-74E2-405C-B587-C438A14F31E6} - C:\WINDOWS\System32\cmog.dll
O20 - Winlogon Notify: waxw2k - C:\WINDOWS\SYSTEM32\waxw2k.dll
O21 - SSODL: PgSLbHcP - {D0E3AFA9-7A49-0503-402B-6AA2B207DAA6} - C:\WINDOWS\System32\ofypn.dll
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: Hardware Clock Driver (hwclock) - Unknown owner - C:\WINDOWS\System32\hwclock.exe (file missing)
O23 - Service: IMAPI CD-Burning COM Service (ImapiService) - Roxio Inc. - C:\WINDOWS\System32\ImapiRox.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: SystemManager - Unknown owner - C:\WINDOWS\sysmanager.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\system32\YPCSER~1.EXE
Post #2
Hello DanDan, welcome to the forum

Download CW-Shredder at the link below: (don't run it yet)
http://www.trendmicro.com/ftp/products/onl…/cwshredder.exe

Download 'SpSeHjfix'. into a folder. (don't run it yet)

Clean out temporary and TIF files. Go to Start > Run and type in the box: cleanmgr. Let it scan your system for files to remove. Make sure these 3 are checked and then press *ok* to remove:

Temporary Files
Temporary Internet Files
Recycle Bin



Reboot into safe mode.


Restart your computer in Safe Mode.

Press F8 after the Power-On Self Test (POST) is done. If the Windows Advanced Options Menu does not appear, try restarting and then pressing F8 several times after the POST screen.
Choose the Safe Mode option from the Windows Advanced Options Menu then press Enter.


Disconnect from the net and Close ALL OPEN PROGRAMS.
Run 'SpSeHjfix'. and click on "Start Disinfection".
When it's finished it will reboot your machine to finish the cleaning process.
The tool creates a log of the fix which will appear in the folder.

Now run the Shredder - Hit The FIX button!

Reboot and repeat the process above starting with Reboot in Safe Mode.

Reboot and post a fresh HJT log and the log that was created by 'SpSeHjfix'.



run it in safe mode and run it twice
Post #5
The cleanmgr routine has just finished but without flashing up any OK or dialogue box - not sure whether that's normal

Also some further info:

weird system tray "virus infection" icon has now gone. It was a red circle with a ! in it.

when I opened MS Outlook (not Express) it sent four messages which were not pending as far as I know and which do not now show up in the 'sent items' folder. This I find a bit spooky.

Last night I also tried fixing some of the R1 stuff with HJT e.g. HKLM \……\about:blank and I have the latest log below. So as not to confuse the picture please note the log below does not contain any of your suggested fixes yet; I will repost the latest in a fresh post when I have been through the rest of your routines
Thanks
DB

Logfile of HijackThis v1.99.1
Scan saved at 12:31:16, on 29/10/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Creative\SB Live! 24-bit\Surround Mixer\CTSysVol.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\vmlib.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\Tiscali\tkonnect\tkonnect.exe
C:\WINDOWS\System32\CTSVCCD.EXE
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\BigFix\BigFix.exe
C:\WINDOWS\DvzCommon\DvzMsgr.exe
C:\WINDOWS\System32\msdtc.exe
C:\Program Files\Hewlett-Packard\AiO\hp psc 900 series\Bin\hpobrt07.exe
C:\Program Files\Palm\HOTSYNC.EXE
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\PROGRA~1\HEWLET~1\AiO\Shared\Bin\hpoevm07.exe
C:\WINDOWS\System32\hpoipm07.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\sysmanager.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\sllights.exe
C:\Program Files\Hewlett-Packard\AiO\Shared\bin\hpOSTS07.exe
C:\Program Files\Hewlett-Packard\AiO\Shared\bin\hpOFXM07.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\FONTAN~1\LOCALS~1\Temp\se.dll/space.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\FONTAN~1\LOCALS~1\Temp\se.dll/space.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.red.clientapps.yahoo.com/customi…arch.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.windowsmedia.com/
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_17_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O2 - BHO: (no name) - {D3AE36A1-4012-479A-9EE6-1709A0068F0F} - C:\WINDOWS\System32\cmog.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: BT Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_17_0.dll
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Probe\AsusProb.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\BTYAHO~1\Help\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [M_S DVD DirectX Dll Drivers] msxdl.exe
O4 - HKLM\..\Run: [CT Control Settings] CTSVCCD.EXE
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [AsioReg] REGSVR32 /S CTASIO.DLL
O4 - HKLM\..\Run: [DevconDefaultDB] C:\WINDOWS\READREG /PSCONV={NO}
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SB Live! 24-bit\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [intel32.exe] C:\WINDOWS\System32\intel32.exe
O4 - HKLM\..\Run: [icasServ] C:\WINDOWS\System32\icasServ.exe
O4 - HKLM\..\Run: [vmlib] vmlib.exe
O4 - HKLM\..\Run: [P.S.Guard] C:\Program Files\P.S.Guard\PSGuard.exe
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - HKLM\..\Run: [sp] rundll32 C:\DOCUME~1\FONTAN~1\LOCALS~1\Temp\se.dll,DllInstall
O4 - HKLM\..\RunServices: [M_S DVD DirectX Dll Drivers] msxdl.exe
O4 - HKLM\..\RunServices: [CT Control Settings] CTSVCCD.EXE
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [M_S DVD DirectX Dll Drivers] msxdl.exe
O4 - HKCU\..\Run: [tkonnect] C:\Program Files\Tiscali\tkonnect\tkonnect.exe updatemode
O4 - HKCU\..\Run: [CT Control Settings] CTSVCCD.EXE
O4 - HKCU\..\Run: [SetDefaultMIDI] MIDIDef.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [aupd] C:\WINDOWS\System32\sysvcs.exe
O4 - HKCU\..\RunServices: [M_S DVD DirectX Dll Drivers] msxdl.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\BigFix.exe
O4 - Global Startup: DataViz Messenger.lnk = C:\WINDOWS\DvzCommon\DvzMsgr.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: BT Yahoo! Sidebar - {51085E3D-A958-42A2-A6BE-A6A9B0BAF276} - C:\Program Files\Yahoo!\browser\ysidebarIE.dll
O9 - Extra 'Tools' menuitem: BT &Yahoo! Sidebar - {51085E3D-A958-42A2-A6BE-A6A9B0BAF276} - C:\Program Files\Yahoo!\browser\ysidebarIE.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O12 - Plugin for .avi: C:\Program Files\Netscape\Communicator\Program\PLUGINS\npavi32.dll
O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .pdf: C:\Program Files\Netscape\Communicator\Program\PLUGINS\nppdf32.dll
O16 - DPF: {231B1C6E-F934-42A2-92B6-C2FEFEC24276} (yucsetreg Class) - C:\Program Files\Yahoo!\common\yucconfig.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\common\yinsthelper.dll
O18 - Filter: text/html - {12873269-74E2-405C-B587-C438A14F31E6} - C:\WINDOWS\System32\cmog.dll
O18 - Filter: text/plain - {12873269-74E2-405C-B587-C438A14F31E6} - C:\WINDOWS\System32\cmog.dll
O20 - Winlogon Notify: waxw2k - C:\WINDOWS\SYSTEM32\waxw2k.dll
O21 - SSODL: PgSLbHcP - {D0E3AFA9-7A49-0503-402B-6AA2B207DAA6} - C:\WINDOWS\System32\ofypn.dll
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: Hardware Clock Driver (hwclock) - Unknown owner - C:\WINDOWS\System32\hwclock.exe (file missing)
O23 - Service: IMAPI CD-Burning COM Service (ImapiService) - Roxio Inc. - C:\WINDOWS\System32\ImapiRox.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: SystemManager - Unknown owner - C:\WINDOWS\sysmanager.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\system32\YPCSER~1.EXE
Post #6
Make SURE you are running the fix in Safe Mode and you are Disconnected from the net
You might want to unplug your connection until finished.
Post #7
OK then some more info and logs.
My firewall tells me that the following are attempting to access the net:
vmlib.exe
sysvcs.exe
icasServ.exe
Not sure whether these are dodgy or not.

Also I get the following warning, even though IE is not running:
"Microsoft Internet Explorer. This window is busy. Closing this window may cause some problems. Do you want to close it anyway? Yes No" I chose yes…

Logs:
SpSeHjfix

(10/29/05 14:44:31) SPSeHjFix started v1.1.2
(10/29/05 14:44:31) OS: WinXP (5.1.2600)
(10/29/05 14:44:31) Language: english
(10/29/05 14:44:31) Win-Path: C:\WINDOWS
(10/29/05 14:44:31) System-Path: C:\WINDOWS\System32
(10/29/05 14:44:31) Temp-Path: C:\DOCUME~1\FONTAN~1\LOCALS~1\Temp\
(10/29/05 14:44:42) Disinfection started
(10/29/05 14:44:42) Bad-Dll(IEP): c:\docume~1\fontan~1\locals~1\temp\se.dll
(10/29/05 14:44:42) Searchassistant Uninstaller found: regsvr32 /s /u C:\WINDOWS\System32\cmog.dll
(10/29/05 14:44:42) Searchassistant Uninstaller - Keys Deleted
(10/29/05 14:44:42) UBF: 6 - UBB: 4 - UBR: 34
(10/29/05 14:44:42) FilterKey: HKCR\text/html (deleted)
(10/29/05 14:44:42) FilterKey: HKCR\CLSID\{12873269-74E2-405C-B587-C438A14F31E6} (deleted)
(10/29/05 14:44:42) FilterKey: HKLM\SOFTWARE\Classes\text/html (error while deleting)
(10/29/05 14:44:42) FilterKey: HKCR\text/plain (deleted)
(10/29/05 14:44:42) FilterKey: HKCR\CLSID\{12873269-74E2-405C-B587-C438A14F31E6} (error while deleting)
(10/29/05 14:44:42) FilterKey: HKLM\SOFTWARE\Classes\text/plain (error while deleting)
(10/29/05 14:44:42) BHO-Key: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D3AE36A1-4012-479A-9EE6-1709A0068F0F} (deleted)
(10/29/05 14:44:42) BHO-Key: HKCR\CLSID\{D3AE36A1-4012-479A-9EE6-1709A0068F0F} (deleted)
(10/29/05 14:44:42) Run-Key: HKLM\Software\Microsoft\Windows\CurrentVersion\Run\sp=rundll32 C:\DOCUME~1\FONTAN~1\LOCALS~1\Temp\se.dll,DllInstall (deleted)
(10/29/05 14:44:42) UBF: 4 - UBB: 3 - UBR: 33
(10/29/05 14:44:42) Bad IE-pages:
deleted: HKCU\Software\Microsoft\Internet Explorer\Main, Search Bar: res://c:\docume~1\fontan~1\locals~1\temp\se.dll/space.html
deleted: HKCU\Software\Microsoft\Internet Explorer\Main, Search Page: about:blank
deleted: HKCU\Software\Microsoft\Internet Explorer\Main, Start Page: about:blank
deleted: HKCU\Software\Microsoft\Internet Explorer\Main, HomeOldSP: about:blank
deleted: HKCU\Software\Microsoft\Internet Explorer\Search, SearchAssistant: about:blank
deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Search Bar: res://c:\docume~1\fontan~1\locals~1\temp\se.dll/space.html
deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Search Page: about:blank
deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Start Page: about:blank
deleted: HKLM\Software\Microsoft\Internet Explorer\Main, HomeOldSP: about:blank
deleted: HKLM\Software\Microsoft\Internet Explorer\Search, SearchAssistant: about:blank
(10/29/05 14:44:42) Stealth-String not found
(10/29/05 14:44:42) File added to delete: c:\windows\system32\cmog.dll
(10/29/05 14:44:42) File added to delete: c:\docume~1\fontan~1\locals~1\temp\se.dll
(10/29/05 14:44:42) Reboot


(10/29/05 14:46:03) SPSeHjFix started v1.1.2
(10/29/05 14:46:03) OS: WinXP (5.1.2600)
(10/29/05 14:46:03) Language: english
(10/29/05 14:46:03) Win-Path: C:\WINDOWS
(10/29/05 14:46:03) System-Path: C:\WINDOWS\System32
(10/29/05 14:46:03) Temp-Path: C:\DOCUME~1\FONTAN~1\LOCALS~1\Temp\
(10/29/05 14:46:38) Disinfection started
(10/29/05 14:46:38) Bad-Dll(IEP): (not found)
(10/29/05 14:46:38) Bad-Dll(IEP) in BHO: (not found)
(10/29/05 14:46:38) UBF: 4 - UBB: 3 - UBR: 33
(10/29/05 14:46:38) UBF: 4 - UBB: 3 - UBR: 33
(10/29/05 14:46:38) Bad IE-pages: (none)
(10/29/05 14:46:38) Stealth-String not found
(10/29/05 14:46:38) Not infected->END


(10/29/05 14:53:14) SPSeHjFix started v1.1.2
(10/29/05 14:53:14) OS: WinXP (5.1.2600)
(10/29/05 14:53:14) Language: english
(10/29/05 14:53:14) Win-Path: C:\WINDOWS
(10/29/05 14:53:14) System-Path: C:\WINDOWS\System32
(10/29/05 14:53:14) Temp-Path: C:\DOCUME~1\FONTAN~1\LOCALS~1\Temp\
(10/29/05 14:53:16) Disinfection started
(10/29/05 14:53:16) Bad-Dll(IEP): (not found)
(10/29/05 14:53:16) Bad-Dll(IEP) in BHO: (not found)
(10/29/05 14:53:16) UBF: 4 - UBB: 3 - UBR: 32
(10/29/05 14:53:16) UBF: 4 - UBB: 3 - UBR: 32
(10/29/05 14:53:16) Bad IE-pages: (none)
(10/29/05 14:53:16) Stealth-String not found
(10/29/05 14:53:16) Not infected->END


HJT:

Logfile of HijackThis v1.99.1
Scan saved at 15:06:05, on 29/10/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\msdtc.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\sysmanager.exe
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\WINDOWS\System32\CTSVCCD.EXE
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Creative\SB Live! 24-bit\Surround Mixer\CTSysVol.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\WINDOWS\System32\vmlib.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Tiscali\tkonnect\tkonnect.exe
C:\WINDOWS\System32\rundll32.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\BigFix\BigFix.exe
C:\WINDOWS\DvzCommon\DvzMsgr.exe
C:\Program Files\Hewlett-Packard\AiO\hp psc 900 series\Bin\hpobrt07.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\system32\fxssvc.exe
C:\Program Files\Palm\HOTSYNC.EXE
C:\WINDOWS\sllights.exe
C:\PROGRA~1\HEWLET~1\AiO\Shared\Bin\hpoevm07.exe
C:\WINDOWS\System32\hpoipm07.exe
C:\Program Files\Hewlett-Packard\AiO\Shared\bin\hpOSTS07.exe
C:\Program Files\Hewlett-Packard\AiO\Shared\bin\hpOFXM07.exe
C:\Program Files\Netscape\Netscape Browser\netscape.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.red.clientapps.yahoo.com/customi…arch.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.windowsmedia.com/
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_17_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: BT Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_17_0.dll
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Probe\AsusProb.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\BTYAHO~1\Help\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [M_S DVD DirectX Dll Drivers] msxdl.exe
O4 - HKLM\..\Run: [CT Control Settings] CTSVCCD.EXE
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [AsioReg] REGSVR32 /S CTASIO.DLL
O4 - HKLM\..\Run: [DevconDefaultDB] C:\WINDOWS\READREG /PSCONV={NO}
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SB Live! 24-bit\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [intel32.exe] C:\WINDOWS\System32\intel32.exe
O4 - HKLM\..\Run: [icasServ] C:\WINDOWS\System32\icasServ.exe
O4 - HKLM\..\Run: [vmlib] vmlib.exe
O4 - HKLM\..\Run: [P.S.Guard] C:\Program Files\P.S.Guard\PSGuard.exe
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - HKLM\..\RunServices: [M_S DVD DirectX Dll Drivers] msxdl.exe
O4 - HKLM\..\RunServices: [CT Control Settings] CTSVCCD.EXE
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [M_S DVD DirectX Dll Drivers] msxdl.exe
O4 - HKCU\..\Run: [tkonnect] C:\Program Files\Tiscali\tkonnect\tkonnect.exe updatemode
O4 - HKCU\..\Run: [CT Control Settings] CTSVCCD.EXE
O4 - HKCU\..\Run: [SetDefaultMIDI] MIDIDef.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [aupd] C:\WINDOWS\System32\sysvcs.exe
O4 - HKCU\..\RunServices: [M_S DVD DirectX Dll Drivers] msxdl.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\BigFix.exe
O4 - Global Startup: DataViz Messenger.lnk = C:\WINDOWS\DvzCommon\DvzMsgr.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: BT Yahoo! Sidebar - {51085E3D-A958-42A2-A6BE-A6A9B0BAF276} - C:\Program Files\Yahoo!\browser\ysidebarIE.dll
O9 - Extra 'Tools' menuitem: BT &Yahoo! Sidebar - {51085E3D-A958-42A2-A6BE-A6A9B0BAF276} - C:\Program Files\Yahoo!\browser\ysidebarIE.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O12 - Plugin for .avi: C:\Program Files\Netscape\Communicator\Program\PLUGINS\npavi32.dll
O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .pdf: C:\Program Files\Netscape\Communicator\Program\PLUGINS\nppdf32.dll
O16 - DPF: {231B1C6E-F934-42A2-92B6-C2FEFEC24276} (yucsetreg Class) - C:\Program Files\Yahoo!\common\yucconfig.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\common\yinsthelper.dll
O20 - Winlogon Notify: waxw2k - C:\WINDOWS\SYSTEM32\waxw2k.dll
O21 - SSODL: PgSLbHcP - {D0E3AFA9-7A49-0503-402B-6AA2B207DAA6} - C:\WINDOWS\System32\ofypn.dll
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: Hardware Clock Driver (hwclock) - Unknown owner - C:\WINDOWS\System32\hwclock.exe (file missing)
O23 - Service: IMAPI CD-Burning COM Service (ImapiService) - Roxio Inc. - C:\WINDOWS\System32\ImapiRox.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: SystemManager - Unknown owner - C:\WINDOWS\sysmanager.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\system32\YPCSER~1.EXE

Thanks for all the help so far. I'll appreciate a reply when you get around to it
DB
Post #8
vmlib.exe
sysvcs.exe
icasServ.exe
I'm pretty sure all those are bad. Don't do anything with them yet.





Please download the trial version of Ewido Security Suite here:
http://www.ewido.net/en/download/
Install it, and update the definitions to the newest files. Do NOT run a scan yet.


Next, please reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Select the first option, to run Windows in Safe Mode.


Then please run Ewido, click on the Scanner run a full scan and let it clean everything it finds. Save the logfile from the scan.


Restart your computer in normal mode and please post a new HijackThis log, as well as the log from the Ewido scan.
Post #9
found some items flashed up after installing ewido. This was even BEFORE reboot/scan routine. I marked them for no action so far. I guess we can go back to them. They are: File Path Infection ofypn.dll c:\WINDOWS\SYSTEM32 TrojanProxy.agent.df OLEADM.dll c:\WINDOWS\SYSTEM32 Trojan.agent.ff sysmanager.exe C:windows Backdoor.SdBot.aad CTSVCCD.EXE c:\WINDOWS\SYSTEM32 Backdoor.Rbot.mg I’ll now do your routine in the right sequence DB
Post #11
Hi the ewido scan alone took nearly 90 minutes! Anyhow here it is - HJT scan to follow right after Cheers DB ——————————————————— ewido security suite - Scan report ——————————————————— + Created on: 18:12:57, 29/10/2005 + Report-Checksum: 2F8B8DA2 + Scan result: HKLM\SOFTWARE\Classes\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C} -> Spyware.Gator : Cleaned with backup HKLM\SOFTWARE\Classes\CLSID\{357A87ED-3E5D-437d-B334-DEB7EB4982A3} -> Trojan.Agent.eo : Cleaned with backup HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a} -> Spyware.Alexa : Cleaned with backup HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/HDPlugin1101.dll\\.Owner -> Spyware.Gator : Cleaned with backup HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/HDPlugin1101.dll\\{DBAE7000-01EC-4162-8FEB-8A27AC937CA0} -> Spyware.Gator : Cleaned with backup HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Internet Update\{357A87ED-3E5D-437d-B334-DEB7EB4982A3} -> Trojan.Agent.eo : Cleaned with backup HKLM\SOFTWARE\PSGuard.com -> Spyware.PSGuard : Error during cleaning HKLM\SOFTWARE\PSGuard.com\PSGuard -> Spyware.PSGuard : Error during cleaning HKLM\SOFTWARE\PSGuard.com\PSGuard\P.S.Guard -> Spyware.PSGuard : Error during cleaning HKLM\SOFTWARE\PSGuard.com\PSGuard\P.S.Guard\License -> Spyware.PSGuard : Cleaned with backup HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\\{c95fe080-8f5d-11d2-a20b-00aa003c157a} -> Spyware.Alexa : Cleaned with backup HKU\S-1-5-21-4189850523-2389969595-2291903390-1005\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\\{c95fe080-8f5d-11d2-a20b-00aa003c157a} -> Spyware.Alexa : Cleaned with backup HKU\S-1-5-18\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\\{c95fe080-8f5d-11d2-a20b-00aa003c157a} -> Spyware.Alexa : Error during cleaning [228] C:\WINDOWS\system32\OLEADM.dll -> Trojan.Agent.ff : Cleaned with backup [472] C:\WINDOWS\system32\OLEADM.dll -> Trojan.Agent.ff : Error during cleaning [728] C:\WINDOWS\System32\OLEADM.dll -> Trojan.Agent.ff : Error during cleaning C:\ct45.exe/y.bat -> Trojan.Zapchast : Error during cleaning :mozilla.9:C:\Documents and Settings\Fontanive\Application Data\Netscape\NSB\Profiles\xjhlzoum.default\cookies.txt -> Spyware.Cookie.Mediaplex : Cleaned with backup :mozilla.23:C:\Documents and Settings\Fontanive\Application Data\Netscape\NSB\Profiles\xjhlzoum.default\cookies.txt -> Spyware.Cookie.Adjuggler : Cleaned with backup :mozilla.24:C:\Documents and Settings\Fontanive\Application Data\Netscape\NSB\Profiles\xjhlzoum.default\cookies.txt -> Spyware.Cookie.Myaffiliateprogram : Cleaned with backup :mozilla.30:C:\Documents and Settings\Fontanive\Application Data\Netscape\NSB\Profiles\xjhlzoum.default\cookies.txt -> Spyware.Cookie.Estat : Cleaned with backup :mozilla.33:C:\Documents and Settings\Fontanive\Application Data\Netscape\NSB\Profiles\xjhlzoum.default\cookies.txt -> Spyware.Cookie.Smartadserver : Cleaned with backup :mozilla.34:C:\Documents and Settings\Fontanive\Application Data\Netscape\NSB\Profiles\xjhlzoum.default\cookies.txt -> Spyware.Cookie.Smartadserver : Cleaned with backup :mozilla.35:C:\Documents and Settings\Fontanive\Application Data\Netscape\NSB\Profiles\xjhlzoum.default\cookies.txt -> Spyware.Cookie.Smartadserver : Cleaned with backup :mozilla.36:C:\Documents and Settings\Fontanive\Application Data\Netscape\NSB\Profiles\xjhlzoum.default\cookies.txt -> Spyware.Cookie.Doubleclick : Cleaned with backup :mozilla.38:C:\Documents and Settings\Fontanive\Application Data\Netscape\NSB\Profiles\xjhlzoum.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.39:C:\Documents and Settings\Fontanive\Application Data\Netscape\NSB\Profiles\xjhlzoum.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.40:C:\Documents and Settings\Fontanive\Application Data\Netscape\NSB\Profiles\xjhlzoum.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.41:C:\Documents and Settings\Fontanive\Application Data\Netscape\NSB\Profiles\xjhlzoum.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.42:C:\Documents and Settings\Fontanive\Application Data\Netscape\NSB\Profiles\xjhlzoum.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.46:C:\Documents and Settings\Fontanive\Application Data\Netscape\NSB\Profiles\xjhlzoum.default\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup :mozilla.48:C:\Documents and Settings\Fontanive\Application Data\Netscape\NSB\Profiles\xjhlzoum.default\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup :mozilla.49:C:\Documents and Settings\Fontanive\Application Data\Netscape\NSB\Profiles\xjhlzoum.default\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup :mozilla.50:C:\Documents and Settings\Fontanive\Application Data\Netscape\NSB\Profiles\xjhlzoum.default\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup :mozilla.51:C:\Documents and Settings\Fontanive\Application Data\Netscape\NSB\Profiles\xjhlzoum.default\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup :mozilla.52:C:\Documents and Settings\Fontanive\Application Data\Netscape\NSB\Profiles\xjhlzoum.default\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup :mozilla.55:C:\Documents and Settings\Fontanive\Application Data\Netscape\NSB\Profiles\xjhlzoum.default\cookies.txt -> Spyware.Cookie.Bluestreak : Cleaned with backup :mozilla.68:C:\Documents and Settings\Fontanive\Application Data\Netscape\NSB\Profiles\xjhlzoum.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.69:C:\Documents and Settings\Fontanive\Application Data\Netscape\NSB\Profiles\xjhlzoum.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.70:C:\Documents and Settings\Fontanive\Application Data\Netscape\NSB\Profiles\xjhlzoum.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\fontanive@112.2o7[2].txt -> Spyware.Cookie.2o7 : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\fontanive@122.2o7[1].txt -> Spyware.Cookie.2o7 : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\fontanive@247realmedia[1].txt -> Spyware.Cookie.247realmedia : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\fontanive@2o7[1].txt -> Spyware.Cookie.2o7 : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][2].txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\fontanive@adbutler[1].txt -> Spyware.Cookie.Adbutler : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][1].txt -> Spyware.Cookie.Euroclick : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][1].txt -> Spyware.Cookie.Pointroll : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\fontanive@adtech[2].txt -> Spyware.Cookie.Adtech : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\fontanive@advertising[2].txt -> Spyware.Cookie.Advertising : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\fontanive@adviva[2].txt -> Spyware.Cookie.Adviva : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][1].txt -> Spyware.Cookie.Falkag : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][2].txt -> Spyware.Cookie.Falkag : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][1].txt -> Spyware.Cookie.Falkag : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\fontanive@atdmt[2].txt -> Spyware.Cookie.Atdmt : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\fontanive@bfast[2].txt -> Spyware.Cookie.Bfast : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\fontanive@bluestreak[2].txt -> Spyware.Cookie.Bluestreak : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed]-sys[1].txt -> Spyware.Cookie.Serving-sys : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\fontanive@burstnet[1].txt -> Spyware.Cookie.Burstnet : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\fontanive@casalemedia[1].txt -> Spyware.Cookie.Casalemedia : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\fontanive@centrport[1].txt -> Spyware.Cookie.Centrport : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\fontanive@commission-junction[1].txt -> Spyware.Cookie.Commission-junction : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\fontanive@com[2].txt -> Spyware.Cookie.Com : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][2].txt -> Spyware.Cookie.Hitslink : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][2].txt -> Spyware.Cookie.Hitslink : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][2].txt -> Spyware.Cookie.Sexcounter : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][1].txt -> Spyware.Cookie.Coremetrics : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\fontanive@doubleclick[1].txt -> Spyware.Cookie.Doubleclick : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][1].txt -> Spyware.Cookie.Esomniture : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][1].txt -> Spyware.Cookie.Esomniture : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][1].txt -> Spyware.Cookie.Esomniture : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][1].txt -> Spyware.Cookie.Esomniture : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][1].txt -> Spyware.Cookie.Esomniture : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][1].txt -> Spyware.Cookie.Esomniture : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][1].txt -> Spyware.Cookie.Esomniture : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][1].txt -> Spyware.Cookie.Esomniture : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][1].txt -> Spyware.Cookie.Esomniture : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][1].txt -> Spyware.Cookie.Esomniture : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][1].txt -> Spyware.Cookie.Esomniture : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][1].txt -> Spyware.Cookie.Esomniture : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\fontanive@edge.ru4[1].txt -> Spyware.Cookie.Ru4 : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][1].txt -> Spyware.Cookie.Hitbox : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][1].txt -> Spyware.Cookie.Hitbox : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][2].txt -> Spyware.Cookie.Hitbox : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][1].txt -> Spyware.Cookie.Hitbox : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][1].txt -> Spyware.Cookie.Hitbox : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][2].txt -> Spyware.Cookie.Hitbox : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][1].txt -> Spyware.Cookie.Hitbox : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][2].txt -> Spyware.Cookie.Hitbox : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][1].txt -> Spyware.Cookie.Hitbox : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][2].txt -> Spyware.Cookie.Hitbox : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][1].txt -> Spyware.Cookie.Hitbox : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][2].txt -> Spyware.Cookie.Hitbox : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][2].txt -> Spyware.Cookie.Hitbox : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][2].txt -> Spyware.Cookie.Hitbox : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][2].txt -> Spyware.Cookie.Hitbox : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][2].txt -> Spyware.Cookie.Hitbox : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][1].txt -> Spyware.Cookie.Hitbox : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][2].txt -> Spyware.Cookie.Hitbox : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][2].txt -> Spyware.Cookie.Hitbox : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][1].txt -> Spyware.Cookie.Hitbox : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][1].txt -> Spyware.Cookie.Hitbox : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\fontanive@estat[1].txt -> Spyware.Cookie.Estat : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\fontanive@falkag[1].txt -> Spyware.Cookie.Falkag : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\fontanive@fastclick[1].txt -> Spyware.Cookie.Fastclick : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\fontanive@findwhat[1].txt -> Spyware.Cookie.Findwhat : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][1].txt -> Spyware.Cookie.Comclick : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\fontanive@flukecorporation.122.2o7[2].txt -> Spyware.Cookie.2o7 : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\fontanive@hitbox[1].txt -> Spyware.Cookie.Hitbox : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][1].txt -> Spyware.Cookie.Itrack : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\fontanive@ivwbox[1].txt -> Spyware.Cookie.Ivwbox : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\fontanive@mediaplex[1].txt -> Spyware.Cookie.Mediaplex : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\fontanive@oewabox[1].txt -> Spyware.Cookie.Oewabox : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\fontanive@overture[1].txt -> Spyware.Cookie.Overture : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\fontanive@paypopup[1].txt -> Spyware.Cookie.Paypopup : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][1].txt -> Spyware.Cookie.Overture : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][2].txt -> Spyware.Cookie.Hitbox : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][1].txt -> Spyware.Cookie.Popularix : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\fontanive@qksrv[1].txt -> Spyware.Cookie.Qksrv : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\fontanive@questionmarket[1].txt -> Spyware.Cookie.Questionmarket : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\fontanive@revenue[2].txt -> Spyware.Cookie.Revenue : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][1].txt -> Spyware.Cookie.Adjuggler : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][1].txt -> Spyware.Cookie.Falkag : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][2].txt -> Spyware.Cookie.Advertising : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][2].txt -> Spyware.Cookie.Liveperson : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\fontanive@serving-sys[2].txt -> Spyware.Cookie.Serving-sys : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\fontanive@spylog[2].txt -> Spyware.Cookie.Spylog : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][2].txt -> Spyware.Cookie.Onestat : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\fontanive@statcounter[1].txt -> Spyware.Cookie.Statcounter : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][2].txt -> Spyware.Cookie.Webtrendslive : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\fontanive@targetnet[1].txt -> Spyware.Cookie.Targetnet : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\fontanive@tradedoubler[1].txt -> Spyware.Cookie.Tradedoubler : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\fontanive@trafficmp[1].txt -> Spyware.Cookie.Trafficmp : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\fontanive@trafic[1].txt -> Spyware.Cookie.Trafic : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\fontanive@tribalfusion[1].txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][1].txt -> Spyware.Cookie.Coremetrics : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\fontanive@valueclick[1].txt -> Spyware.Cookie.Valueclick : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\fontanive@weborama[2].txt -> Spyware.Cookie.Weborama : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][1].txt -> Spyware.Cookie.Myaffiliateprogram : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][2].txt -> Spyware.Cookie.Popuptraffic : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][1].txt -> Spyware.Cookie.Smartadserver : Cleaned with backup C:\Documents and Settings\Fontanive\Cookies\[removed][1].txt -> Spyware.Cookie.Adserver : Cleaned with backup C:\Documents and Settings\Fontanive\Local Settings\Temp\55605396.exe -> TrojanProxy.Lager.x : Cleaned with backup C:\Documents and Settings\Fontanive\Local Settings\Temp\ICD1.tmp\internazionale_ver11.ocx.tcf -> Spyware.AdPowerZone : Cleaned with backup C:\Documents and Settings\Fontanive\Local Settings\Temp\ICD2.tmp\internazionale_ver11.ocx.tcf -> Spyware.AdPowerZone : Cleaned with backup C:\Documents and Settings\Fontanive\Local Settings\Temp\ICD3.tmp\UWFX5_0001_LP1014NetInstaller.exe -> Not-A-Virus.Downloader.Agent.d : Cleaned with backup C:\Documents and Settings\Fontanive\Local Settings\Temp\oxyzcvxp.exe -> TrojanSpy.Goldun.du : Cleaned with backup C:\Documents and Settings\Fontanive\Local Settings\Temp\rsysinit.exe -> Trojan.ExitWin.z : Cleaned with backup C:\Documents and Settings\Fontanive\Local Settings\Temporary Internet Files\Content.IE5\1WCRHD45\WinFixer2005ScannerInstall[1].cab/UWFX5_0001_LP1014NetInstaller.exe -> Not-A-Virus.Downloader.Agent.d : Error during cleaning C:\Documents and Settings\Fontanive\Local Settings\Temporary Internet Files\Content.IE5\37XFNPWW\dba250[1].exe -> Dialer.Generic : Cleaned with backup C:\Documents and Settings\Fontanive\Local Settings\Temporary Internet Files\Content.IE5\37XFNPWW\latest[1].exe -> Trojan.Crypt.l : Cleaned with backup C:\Documents and Settings\Fontanive\Local Settings\Temporary Internet Files\Content.IE5\37XFNPWW\latest[2].exe -> Trojan.Crypt.l : Cleaned with backup C:\Documents and Settings\Fontanive\Local Settings\Temporary Internet Files\Content.IE5\37XFNPWW\runapl[1].exe -> Trojan.LowZones.cu : Cleaned with backup C:\Documents and Settings\Fontanive\msdirectx.sys -> Trojan.Rootkit.h : Cleaned with backup C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\GYGASJMP\g[1].exe -> Backdoor.SdBot.aad : Cleaned with backup C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\GYGASJMP\joysaver[1].cab/m67m.ocx -> Spyware.MediaMotor : Error during cleaning C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\RTEYCIY0\m11[1].jpe/y.bat -> Trojan.Zapchast : Error during cleaning C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\THNR8LTP\ee[1].exe -> Backdoor.SdBot.aad : Cleaned with backup C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\THNR8LTP\ee[2].exe -> Backdoor.SdBot.aad : Cleaned with backup C:\ntdetecd.exe -> Trojan.LowZones.cu : Cleaned with backup C:\Program Files\hijackthis1982\backups\backup-20051027-233322-321.dll -> Spyware.MediaMotor : Cleaned with backup C:\WINDOWS\Downloaded Program Files\HDPlugin1101.dll -> Adware.Gator : Cleaned with backup C:\WINDOWS\Downloaded Program Files\internazionale_ver11.ocx -> Spyware.AdPowerZone : Cleaned with backup C:\WINDOWS\Downloaded Program Files\UWFX5_0001_LP1014NetInstaller.exe -> Not-A-Virus.Downloader.Agent.d : Cleaned with backup C:\WINDOWS\kansy.reg -> Trojan.WinREG.LowZones.f : Cleaned with backup C:\WINDOWS\kany.reg -> Trojan.WinREG.LowZones.f : Cleaned with backup C:\WINDOWS\ra.reg -> Trojan.WinREG.LowZones.f : Cleaned with backup C:\WINDOWS\sysmanager.exe -> Backdoor.SdBot.aad : Cleaned with backup C:\WINDOWS\system32\CTSVCCD.EXE -> Backdoor.Rbot.mg : Cleaned with backup C:\WINDOWS\system32\icasServ.exe -> Spyware.Hijacker.Generic : Cleaned with backup C:\WINDOWS\system32\intel32.exe.tcf -> Trojan.Agent.ff : Cleaned with backup C:\WINDOWS\system32\latest.exe -> Trojan.Crypt.l : Cleaned with backup C:\WINDOWS\system32\msdirectx.sys -> Trojan.Rootkit.h : Cleaned with backup C:\WINDOWS\system32\ofypn.dll -> TrojanProxy.Agent.df : Cleaned with backup C:\WINDOWS\system32\oleadm.dll -> Trojan.Agent.ff : Cleaned with backup C:\WINDOWS\system32\orans.sys -> Trojan.Rootkit.Agent.ae : Cleaned with backup C:\WINDOWS\system32\QMKKJ.exe -> Backdoor.SdBot.aad : Cleaned with backup C:\WINDOWS\system32\remon.sys -> Trojan.Rootkit.Agent.ab : Cleaned with backup C:\WINDOWS\system32\sysvcs.exe -> Trojan.Crypt.l : Cleaned with backup C:\WINDOWS\system32\vmlib.exe -> Trojan.LowZones.cu : Cleaned with backup C:\WINDOWS\system32\vxdgfx.sys -> TrojanSpy.Goldun.cf : Error during cleaning C:\WINDOWS\system32\waxw2k.dll -> TrojanSpy.Goldun.dg : Cleaned with backup C:\WINDOWS\system32\~update.exe -> Trojan.Crypt.l : Cleaned with backup C:\WINDOWS\Temp\ICD1.tmp\m67m.ocx -> Spyware.MediaMotor : Cleaned with backup C:\WINDOWS\uninstIU.exe -> Trojan.Agent.ff : Cleaned with backup C:\WINDOWS\y.bat -> Trojan.Zapchast : Cleaned with backup ::Report End
Post #12
HJT log at end of post

During the ewido clean-up I got the following messages:

The file "c\documents and settings\…\…\temporary internet files\content.IE5\1WCRHD45\Winfixer2005ScannerInstall[1].cab/UWFX5-0001-LP1014NetInstaller.exe" cannot be removed because it is embedded in the archive "c\documents and settings\…\…\temporary internet files\content.IE5\1WCRHD45\Winfixer2005ScannerInstall[1].cab"
Do you want to remove the whole archive Yes No

The file "c\documents and settings\local service\local settings\temporary internet files\content.IE5\GYGASJMP\joysaver[1].cab/m67m.ocx" cannot be removed because it is embedded in the archive "c\documents and settings\local service\local settings\temporary internet files\content.IE5\GYGASJMP\joysaver[1].cab" Do you want to remove the whole archive Yes No

The file "c\documents and settings\local service\local settings\temporary internet files\content.IE5\m11[1].jpe/y.bat" cannot be removed because it is embedded in the archive "c\documents and settings\local service\local settings\temporary internet files\content.IE5\m11[1].jpe" " Do you want to remove the whole archive Yes No

The file “C:\CT45.exe/y.bat” cannot be removed because it is embedded in the archive “C:\CT45.exe” Do you want to remove the whole archive Yes No

I answered NO to all above.

Now follows HJT log… I feel we’re getting somewhere

Logfile of HijackThis v1.99.1
Scan saved at 18:27:41, on 29/10/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Creative\SB Live! 24-bit\Surround Mixer\CTSysVol.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Tiscali\tkonnect\tkonnect.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\BigFix\BigFix.exe
C:\WINDOWS\DvzCommon\DvzMsgr.exe
C:\Program Files\Hewlett-Packard\AiO\hp psc 900 series\Bin\hpobrt07.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\Palm\HOTSYNC.EXE
C:\WINDOWS\System32\msdtc.exe
C:\PROGRA~1\HEWLET~1\AiO\Shared\Bin\hpoevm07.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\WINDOWS\System32\hpoipm07.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\sllights.exe
C:\Program Files\Hewlett-Packard\AiO\Shared\bin\hpOSTS07.exe
C:\Program Files\Hewlett-Packard\AiO\Shared\bin\hpOFXM07.exe
C:\Program Files\Microsoft Office\Office10\OUTLOOK.EXE
C:\Program Files\Common Files\Microsoft Shared\Speech\sapisvr.exe
C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
C:\Program Files\Netscape\Netscape Browser\netscape.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.red.clientapps.yahoo.com/customi…arch.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.windowsmedia.com/
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_17_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: BT Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_17_0.dll
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Probe\AsusProb.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\BTYAHO~1\Help\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [M_S DVD DirectX Dll Drivers] msxdl.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [AsioReg] REGSVR32 /S CTASIO.DLL
O4 - HKLM\..\Run: [DevconDefaultDB] C:\WINDOWS\READREG /PSCONV={NO}
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SB Live! 24-bit\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [P.S.Guard] C:\Program Files\P.S.Guard\PSGuard.exe
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - HKLM\..\RunServices: [M_S DVD DirectX Dll Drivers] msxdl.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [M_S DVD DirectX Dll Drivers] msxdl.exe
O4 - HKCU\..\Run: [tkonnect] C:\Program Files\Tiscali\tkonnect\tkonnect.exe updatemode
O4 - HKCU\..\Run: [SetDefaultMIDI] MIDIDef.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\RunServices: [M_S DVD DirectX Dll Drivers] msxdl.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\BigFix.exe
O4 - Global Startup: DataViz Messenger.lnk = C:\WINDOWS\DvzCommon\DvzMsgr.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: BT Yahoo! Sidebar - {51085E3D-A958-42A2-A6BE-A6A9B0BAF276} - C:\Program Files\Yahoo!\browser\ysidebarIE.dll
O9 - Extra 'Tools' menuitem: BT &Yahoo! Sidebar - {51085E3D-A958-42A2-A6BE-A6A9B0BAF276} - C:\Program Files\Yahoo!\browser\ysidebarIE.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O12 - Plugin for .avi: C:\Program Files\Netscape\Communicator\Program\PLUGINS\npavi32.dll
O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .pdf: C:\Program Files\Netscape\Communicator\Program\PLUGINS\nppdf32.dll
O16 - DPF: {231B1C6E-F934-42A2-92B6-C2FEFEC24276} (yucsetreg Class) - C:\Program Files\Yahoo!\common\yucconfig.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\common\yinsthelper.dll
O20 - Winlogon Notify: waxw2k - waxw2k.dll (file missing)
O21 - SSODL: PgSLbHcP - {D0E3AFA9-7A49-0503-402B-6AA2B207DAA6} - C:\WINDOWS\System32\ofypn.dll (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: Hardware Clock Driver (hwclock) - Unknown owner - C:\WINDOWS\System32\hwclock.exe (file missing)
O23 - Service: IMAPI CD-Burning COM Service (ImapiService) - Roxio Inc. - C:\WINDOWS\System32\ImapiRox.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: SystemManager - Unknown owner - C:\WINDOWS\sysmanager.exe (file missing)
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\system32\YPCSER~1.EXE
Post #13
I suggest you do this:



Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Clear "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Clear "Hide protected operating system files."
Click Apply, and then click OK.


Please do not delete anything unless instructed to.


Use Add/Remove Programs and remove: If listed.
P.S.Guard


Run hijackthis. Hit None of the above, Click Do a System Scan Only. Put a Check in the box on the left side on these:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) =
http://uk.red.clientapps.yahoo.com/customi…arch.yahoo.com/

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.windowsmedia.com/

O4 - HKLM\..\Run: [M_S DVD DirectX Dll Drivers] msxdl.exe

O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [P.S.Guard] C:\Program Files\P.S.Guard\PSGuard.exe

O4 - HKCU\..\Run: [M_S DVD DirectX Dll Drivers] msxdl.exe

O4 - HKCU\..\RunServices: [M_S DVD DirectX Dll Drivers] msxdl.exe

O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

O20 - Winlogon Notify: waxw2k - waxw2k.dll (file missing)

O21 - SSODL: PgSLbHcP - {D0E3AFA9-7A49-0503-402B-6AA2B207DAA6} - C:\WINDOWS\System32\ofypn.dll (file missing)

O23 - Service: Hardware Clock Driver (hwclock) - Unknown owner - C:\WINDOWS\System32\hwclock.exe (file missing)

Close ALL windows and browsers except HijackThis and click "Fix checked"



Restart in Safe Mode:
Restart your computer.

Press F8 after the Power-On Self Test (POST) is done. If the Windows Advanced Options Menu does not appear, try restarting and then pressing F8 several times after the POST screen.
Choose the Safe Mode option from the Windows Advanced Options Menu then press Enter.





delete these files if listed:
msxdl.exe
C:\WINDOWS\System32\OLEADM.dll
C:\ct45.exe
C:\WINDOWS\system32\vxdgfx.sys



Open C:\Windows\Prefetch\ Delete ALL files in this folder.



Do this also if these Temp Folders are part of your OS.

Also in safe mode navigate to the C:\Windows\Temp folder. Open the Temp folder and go to Edit > Select All then Edit > Delete to delete the entire contents of the Temp folder.


Next navigate to the C:\Documents and Settings\(EVERY LISTED PROFILE USER)\Local Settings\Temp folder. Open the Temp folder and go to Edit > Select All then Edit > Delete to delete the entire contents of the Temp folder.

Finally go to Control Panel > Internet Options. On the General tab under "Temporary Internet Files" Click "Delete Files". Put a check by "Delete Offline Content" and click OK. Click on the Programs tab then click the "Reset Web Settings" button. Click Apply then OK.


Empty the Recycle Bin

Reboot and "copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at the moment.
Post #14
Thanks for the continued support. My PC behaviour seems stable enough; the main problem that I can identify is that when I try to open IE from the start menu nothing appears - (I haven't tried any other way). For my work I use Excel, Word, Palm Desktop, Outlook, Acrobat and Access all working OK, The Palm will synch OK too. I have a HP all-in-one printer/scanner/fax attached which seems to work OK. I'm using Navigator 8, which appears unaffected to write these logs etc. So I'll continue with the fixes - not sure how long it'll take, but I have plenty of time this evening Cheers Dan
Post #15
Hi perhaps being a bit cautious here, but this is what I have done so far: Your instructions: Double-click My Computer. Click the Tools menu, and then click Folder Options. Click the View tab. Clear "Hide file extensions for known file types." Under the "Hidden files" folder, select "Show hidden files and folders." Clear "Hide protected operating system files." Click Apply, and then click OK. OK DID ALL THIS Please do not delete anything unless instructed to. OK DIDN'T DELETE w/o instruction Use Add/Remove Programs and remove: If listed. P.S.Guard WAS NOT LISTED Run hijackthis. Hit None of the above, Click Do a System Scan Only. Put a Check in the box on the left side on these OK DID THIS ON YOUR SUGGESTED LINES Close ALL windows and browsers except HijackThis and click "Fix checked" FIXED ITEMS Restart in Safe Mode: Restart your computer. Press F8 after the Power-On Self Test (POST) is done. If the Windows Advanced Options Menu does not appear, try restarting and then pressing F8 several times after the POST screen. Choose the Safe Mode option from the Windows Advanced Options Menu then press Enter. RESTARTED OK NOW THEN… delete these files if listed: msxdl.exe …………………………………..used search and could not find anywhere on C:\ or subfolders C:\WINDOWS\System32\OLEADM.dll….used search and could not find anywhere on C:\ or subfolders C:\ct45.exe…………………………………..found and scanned with ewido (highlight and right click), INFECTED WITH Trojan.Zapchast, prompted to remove whole archive, selected YES C:\WINDOWS\system32\vxdgfx.sys…….found and scanned with ewido (highlight and right click), INFECTED WITH Trojan.spy.goldun.cf - used ewido "REMOVE" Open C:\Windows\Prefetch\ Delete ALL files in this folder. OK I DID THIS Do this also if these Temp Folders are part of your OS. DID NOT UNDERSTAND QUITE WHAT THIS MEANS SO HAVE GONE NO FURTHER, except I have rebooted as usual to log on here and report. Start up was extraordinarily slow. But IE is working, though I am still using Navi here. Other behaviour I failed to report - I don't seem to be able to set wallpaper (trying to use control panel>display) The rest of your action seemed drastic, and also as pointed out above I did not understand one of the instructions, so I wanted to drop by before continuing. Can you advise about the TEMP FOLDERS comment above which I haven't grasped please? Thanks for a terrific job so far DB Latest HJT log - Logfile of HijackThis v1.99.1 Scan saved at 19:49:41, on 29/10/2005 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\msdtc.exe C:\Program Files\Logitech\MouseWare\system\em_exec.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\System32\CTsvcCDA.exe C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe C:\Program Files\ewido\security suite\ewidoctrl.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\Program Files\Creative\SB Live! 24-bit\Surround Mixer\CTSysVol.exe C:\Program Files\ewido\security suite\ewidoguard.exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\Tiscali\tkonnect\tkonnect.exe C:\WINDOWS\System32\rundll32.exe C:\Program Files\BigFix\BigFix.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\DvzCommon\DvzMsgr.exe C:\Program Files\Hewlett-Packard\AiO\hp psc 900 series\Bin\hpobrt07.exe C:\WINDOWS\system32\slserv.exe C:\Program Files\Palm\HOTSYNC.EXE C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\System32\MsPMSPSv.exe C:\WINDOWS\system32\fxssvc.exe C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe C:\PROGRA~1\HEWLET~1\AiO\Shared\Bin\hpoevm07.exe C:\WINDOWS\System32\hpoipm07.exe C:\WINDOWS\sllights.exe C:\Program Files\Hewlett-Packard\AiO\Shared\bin\hpOSTS07.exe C:\Program Files\Hewlett-Packard\AiO\Shared\bin\hpOFXM07.exe C:\Program Files\Microsoft Office\Office10\OUTLOOK.EXE C:\Program Files\Common Files\Microsoft Shared\Speech\sapisvr.exe C:\Program Files\Microsoft Office\Office10\WINWORD.EXE C:\Program Files\Netscape\Netscape Browser\netscape.exe C:\WINDOWS\explorer.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\hijackthis\HijackThis.exe O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_17_0.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: BT Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_17_0.dll O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Probe\AsusProb.exe O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe" O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\BTYAHO~1\Help\SMARTB~1\MotiveSB.exe O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe O4 - HKLM\..\Run: [AsioReg] REGSVR32 /S CTASIO.DLL O4 - HKLM\..\Run: [DevconDefaultDB] C:\WINDOWS\READREG /PSCONV={NO} O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SB Live! 24-bit\Surround Mixer\CTSysVol.exe /r O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe" O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [tkonnect] C:\Program Files\Tiscali\tkonnect\tkonnect.exe updatemode O4 - HKCU\..\Run: [SetDefaultMIDI] MIDIDef.exe O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet O4 - HKCU\..\RunServices: [M_S DVD DirectX Dll Drivers] msxdl.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\BigFix.exe O4 - Global Startup: DataViz Messenger.lnk = C:\WINDOWS\DvzCommon\DvzMsgr.exe O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll O9 - Extra button: BT Yahoo! Sidebar - {51085E3D-A958-42A2-A6BE-A6A9B0BAF276} - C:\Program Files\Yahoo!\browser\ysidebarIE.dll O9 - Extra 'Tools' menuitem: BT &Yahoo! Sidebar - {51085E3D-A958-42A2-A6BE-A6A9B0BAF276} - C:\Program Files\Yahoo!\browser\ysidebarIE.dll O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file) O12 - Plugin for .avi: C:\Program Files\Netscape\Communicator\Program\PLUGINS\npavi32.dll O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll O12 - Plugin for .pdf: C:\Program Files\Netscape\Communicator\Program\PLUGINS\nppdf32.dll O16 - DPF: {231B1C6E-F934-42A2-92B6-C2FEFEC24276} (yucsetreg Class) - C:\Program Files\Yahoo!\common\yucconfig.dll O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\common\yinsthelper.dll O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe O23 - Service: Hardware Clock Driver (hwclock) - Unknown owner - C:\WINDOWS\System32\hwclock.exe (file missing) O23 - Service: IMAPI CD-Burning COM Service (ImapiService) - Roxio Inc. - C:\WINDOWS\System32\ImapiRox.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe O23 - Service: SystemManager - Unknown owner - C:\WINDOWS\sysmanager.exe (file missing) O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\system32\YPCSER~1.EXE

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI