14 replies to this topic

[biggus]

Been having issues with popups and the like.
Please review the following log file. Thank you in advance.


Logfile of HijackThis v1.99.1
Scan saved at 2:08:27 PM, on 06/11/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\WINDOWS\System32\DVDRAMSV.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\ASUS\Probe\AsusProb.exe
C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe
C:\PROGRA~1\B'SCLI~1\Win2K\BSCLIP.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\P2P Networking\P2P Networking.exe
C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2J1.EXE
C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe
C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDet.EXE
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Winamp280\Winampa.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\SurfAccuracy\SAcc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Creative\MediaSource\RemoteControl\RcMan.exe
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\office.exe
C:\WINDOWS\system32\RAMASST.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Name\My Documents\Downloads\adaware\HijackThis.exe

R3 - URLSearchHook: (no name) - _{00D6A7E7-4A97-456f-848A-3B75BF7554D7} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Probe\AsusProb.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [B'sCLiP] C:\PROGRA~1\B'SCLI~1\Win2K\BSCLIP.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P Networking.exe /AUTOSTART
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [EPSON Stylus Photo R800] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2J1.EXE /P23 "EPSON Stylus Photo R800" /O6 "USB001" /M "Stylus Photo R800"
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [CTDVDDET] C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDet.EXE
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [SBDrvDet] C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe /r
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp280\Winampa.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SurfAccuracy] C:\Program Files\SurfAccuracy\SAcc.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [RemoteCenter] C:\Program Files\Creative\MediaSource\RemoteControl\RcMan.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: office.exe
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://www.lyricshosting.com
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zon...kr.cab31267.cab
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zon...nt.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\System32\DVDRAMSV.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

[LDTate]

Hello biggus, Welcome to the forum.

This is what I suggest you do.


Please do not delete anything unless instructed to.


Go here and run at least one of the online scans, allow them to delete whatever they find:

TrendMicro HouseCall
eTrust AntiVirus Web Scanner
Panda ActiveScan
Note any thing that can't be fixed
Reboot when done.

Next:

Even if you've already run these, make SURE they're up-to-date and run per instructions.

Make sure you have the up-to-date versions of Spybot V 1.4 and Ad-aware SE Build 1.06 . All are free and available below.

Download Spybot, install and update. Then download Ad-aware, install, and update.

Spybot:

Install the program and launch it.

Go to Start > Programs >Spybot > Search & Destroy and choose Spybot S&D

Close ALL windows except Spybot S&D
Click the button to "Search for Updates" and download and install the Updates.
Next click the button "Check for Problems"
When Spybot is complete, it will be showing "RED" (RED) entries "BLACK" entries and "GREEN" (GREEN) entries in the window
Put a check mark beside the RED (RED) entries ONLY.
Choose "Fix Selected Problems" and allow Spybot to fix the RED (RED) entries.

Ad-Aware FULL SCAN:

Install the program and launch it.

1. Launch Ad-Aware SE and run the WebUpdate feature. (Click on the Globe icon > Click connect > Click OK > Click Finish.)
2. Set up the Configurations as follows:
-- Click the Gear wheel at the top of the Ad-Aware window
-- Click General > Safety & Settings: Check (Green) all three.
-- Click Tweak > Cleaning Engine > UNcheck "Always try to unload modules before deletion".
3. Click "Proceed"
4. Click "Scan Now"
5. Deselect "Search for negligible risk entries" as negligible risk entries (MRU's) are not considered to be a threat.
6. Select "Search for low-risk threats"
7. Run the scanner using the Full Scan (Perform full system scan) mode.
8. When the scan has completed, select Next.
9. In the Scanning Results window, select the "Scan Summary" tab.
10. Check the box next to each "target family" you wish to remove.
11. Click next > Click OK.



Empty Recycle Bin

Reboot and "copy/paste" a new log file into this thread.
Also please describe how your computer behaves at the moment.

[biggus]

Thanks LDTate for the help.
I've done what you have recommended.
I am still getting unwanted popups (partypoker etc)

Here is my log file:

Logfile of HijackThis v1.99.1
Scan saved at 9:39:42 PM, on 13/11/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\WINDOWS\System32\DVDRAMSV.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\ASUS\Probe\AsusProb.exe
C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe
C:\PROGRA~1\B'SCLI~1\Win2K\BSCLIP.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\P2P Networking\P2P Networking.exe
C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2J1.EXE
C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe
C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDet.EXE
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Winamp280\Winampa.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\SurfAccuracy\SAcc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Creative\MediaSource\RemoteControl\RcMan.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\RAMASST.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Jeff VanderMeulen\My Documents\Downloads\adaware\HijackThis.exe

R3 - URLSearchHook: (no name) - _{00D6A7E7-4A97-456f-848A-3B75BF7554D7} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Probe\AsusProb.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [B'sCLiP] C:\PROGRA~1\B'SCLI~1\Win2K\BSCLIP.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P Networking.exe /AUTOSTART
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [EPSON Stylus Photo R800] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2J1.EXE /P23 "EPSON Stylus Photo R800" /O6 "USB001" /M "Stylus Photo R800"
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [CTDVDDET] C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDet.EXE
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [SBDrvDet] C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe /r
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp280\Winampa.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SurfAccuracy] C:\Program Files\SurfAccuracy\SAcc.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [RemoteCenter] C:\Program Files\Creative\MediaSource\RemoteControl\RcMan.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://www.lyricshosting.com
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zon...kr.cab31267.cab
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zon...nt.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\System32\DVDRAMSV.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

[LDTate]

Download the trial version of Spy Sweeper from Here

Install it using the Standard Install option. (You will be asked for your e-mail address, it is safe to give it. If you receive alerts from your firewall, allow all activities for Spy Sweeper)

You will be prompted to check for updated definitions, please do so.
(This may take several minutes)

Click on Options > Sweep Options and check Sweep all Folders on Selected drives. Check Local Disc C. Under What to Sweep, check every box.

Click on Sweep and allow it to fully scan your system.If you are prompted to restart the computer, do so immediately. This is a necessary step to kill the infection!

When the sweep has finished, click Remove. Click Select All and then Next

From 'Results', select the Session Log tab. Click Save to File and save the log somewhere convenient.

Exit Spy Sweeper.

Empty Recycle Bin

Reboot and "copy/paste" a new HJT log as well as the Resullts from Spy Sweeper file into this thread.
Also please describe how your computer behaves at the moment.

[biggus]

Hmm... looking good so far.
I appreciate your promptness.

Here's the log file:

Logfile of HijackThis v1.99.1
Scan saved at 10:26:25 PM, on 13/11/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\WINDOWS\System32\DVDRAMSV.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\ASUS\Probe\AsusProb.exe
C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe
C:\PROGRA~1\B'SCLI~1\Win2K\BSCLIP.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\P2P Networking\P2P Networking.exe
C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2J1.EXE
C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe
C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDet.EXE
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Winamp280\Winampa.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Creative\MediaSource\RemoteControl\RcMan.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\RAMASST.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Jeff VanderMeulen\My Documents\Downloads\adaware\HijackThis.exe

R3 - URLSearchHook: (no name) - _{00D6A7E7-4A97-456f-848A-3B75BF7554D7} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Probe\AsusProb.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [B'sCLiP] C:\PROGRA~1\B'SCLI~1\Win2K\BSCLIP.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P Networking.exe /AUTOSTART
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [EPSON Stylus Photo R800] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2J1.EXE /P23 "EPSON Stylus Photo R800" /O6 "USB001" /M "Stylus Photo R800"
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [CTDVDDET] C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDet.EXE
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [SBDrvDet] C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe /r
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp280\Winampa.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [RemoteCenter] C:\Program Files\Creative\MediaSource\RemoteControl\RcMan.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://www.lyricshosting.com
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zon...kr.cab31267.cab
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zon...nt.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\System32\DVDRAMSV.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe

[LDTate]

I need to see the Resullts from Spy Sweeper file into this thread.

[biggus]

Here you go... ******** 9:59 PM: | Start of Session, November 13, 2005 | 9:59 PM: Spy Sweeper started 9:59 PM: Sweep initiated using definitions version 572 9:59 PM: Starting Memory Sweep 10:01 PM: Found Adware: surf accuracy 10:01 PM: Detected running threat: C:\Program Files\SurfAccuracy\SAcc.exe (ID = 180158) 10:01 PM: HKLM\Software\Microsoft\Windows\CurrentVersion\Run || SurfAccuracy (ID = 0) 10:01 PM: Memory Sweep Complete, Elapsed Time: 00:01:52 10:01 PM: Starting Registry Sweep 10:01 PM: Found Adware: altnet 10:01 PM: HKCR\clsid\{3f4d4f88-0198-4921-b630-957f3eb814e0}\ (1 subtraces) (ID = 103460) 10:01 PM: HKCR\clsid\{3646c2bd-3554-49ca-8125-44deefb881de}\ (1 subtraces) (ID = 103462) 10:01 PM: Found Adware: ist yoursitebar 10:01 PM: HKCR\clsid\{42f2c9ba-614f-47c0-b3e3-ecfd34eed658}\ (6 subtraces) (ID = 147829) 10:01 PM: HKLM\software\classes\ysbactivex.installer\ (3 subtraces) (ID = 147849) 10:01 PM: Found Adware: ist software 10:01 PM: HKLM\software\microsoft\windows\currentversion\moduleusage\c:/windows/downloaded program files/ysbactivex.dll\ (2 subtraces) (ID = 147854) 10:01 PM: HKLM\software\microsoft\windows\currentversion\shareddlls\ || c:\windows\downloaded program files\ysbactivex.dll (ID = 147857) 10:01 PM: HKCR\ysbactivex.installer\ (3 subtraces) (ID = 147869) 10:01 PM: HKLM\software\sacc\ (10 subtraces) (ID = 203068) 10:01 PM: HKLM\software\microsoft\windows\currentversion\run\ || surfaccuracy (ID = 203069) 10:01 PM: HKLM\software\microsoft\windows\currentversion\uninstall\sacc\ (2 subtraces) (ID = 203070) 10:01 PM: Found Adware: quicklink search toolbar 10:01 PM: HKLM\software\microsoft\windows\currentversion\uninstall\quick links\ (2 subtraces) (ID = 359457) 10:01 PM: HKLM\software\ql\ (4 subtraces) (ID = 359458) 10:01 PM: HKLM\software\classes\clsid\{42f2c9ba-614f-47c0-b3e3-ecfd34eed658}\ (6 subtraces) (ID = 920458) 10:01 PM: Found Adware: cydoor peer-to-peer dependency 10:01 PM: HKU\S-1-5-21-57989841-602162358-725345543-1003\software\kazaa\promotions\cydoor\ (525 subtraces) (ID = 124527) 10:01 PM: Found Adware: ist sidefind 10:01 PM: HKU\S-1-5-21-57989841-602162358-725345543-1003\software\microsoft\internet explorer\extensions\cmdmapping\ || {10e42047-deb9-4535-a118-b3f6ec39b807} (ID = 141778) 10:01 PM: Registry Sweep Complete, Elapsed Time:00:00:17 10:01 PM: Starting Cookie Sweep 10:01 PM: Found Spy Cookie: 2o7.net cookie 10:01 PM: jeff vandermeulen@2o7[2].txt (ID = 1957) 10:01 PM: Found Spy Cookie: go.com cookie 10:01 PM: jeff vandermeulen@abc.go[2].txt (ID = 2729) 10:01 PM: Found Spy Cookie: about cookie 10:01 PM: jeff vandermeulen@about[1].txt (ID = 2037) 10:01 PM: Found Spy Cookie: yieldmanager cookie 10:01 PM: jeff vandermeulen@ad.yieldmanager[1].txt (ID = 3751) 10:01 PM: Found Spy Cookie: adknowledge cookie 10:01 PM: jeff vandermeulen@adknowledge[2].txt (ID = 2072) 10:01 PM: Found Spy Cookie: hbmediapro cookie 10:01 PM: jeff vandermeulen@adopt.hbmediapro[2].txt (ID = 2768) 10:01 PM: Found Spy Cookie: specificclick.com cookie 10:01 PM: jeff vandermeulen@adopt.specificclick[1].txt (ID = 3400) 10:01 PM: Found Spy Cookie: cc214142 cookie 10:01 PM: jeff vandermeulen@ads.cc214142[2].txt (ID = 2367) 10:01 PM: Found Spy Cookie: bpath cookie 10:01 PM: jeff vandermeulen@ads15.bpath[1].txt (ID = 2321) 10:01 PM: Found Spy Cookie: adultfriendfinder cookie 10:01 PM: jeff vandermeulen@adultfriendfinder[1].txt (ID = 2165) 10:01 PM: Found Spy Cookie: falkag cookie 10:01 PM: jeff vandermeulen@as1.falkag[1].txt (ID = 2650) 10:01 PM: Found Spy Cookie: askmen cookie 10:01 PM: jeff vandermeulen@askmen[2].txt (ID = 2247) 10:01 PM: Found Spy Cookie: atlas dmt cookie 10:01 PM: jeff vandermeulen@atdmt[2].txt (ID = 2253) 10:01 PM: Found Spy Cookie: belnk cookie 10:01 PM: jeff vandermeulen@ath.belnk[1].txt (ID = 2293) 10:01 PM: Found Spy Cookie: atwola cookie 10:01 PM: jeff vandermeulen@atwola[2].txt (ID = 2255) 10:01 PM: Found Spy Cookie: azjmp cookie 10:01 PM: jeff vandermeulen@azjmp[2].txt (ID = 2270) 10:01 PM: Found Spy Cookie: inet-traffic.com cookie 10:01 PM: jeff vandermeulen@banner3.inet-traffic[1].txt (ID = 2856) 10:01 PM: Found Spy Cookie: banner cookie 10:01 PM: jeff vandermeulen@banner[1].txt (ID = 2276) 10:01 PM: jeff vandermeulen@belnk[1].txt (ID = 2292) 10:01 PM: Found Spy Cookie: bizrate cookie 10:01 PM: jeff vandermeulen@bizrate[2].txt (ID = 2308) 10:01 PM: jeff vandermeulen@boardgames.about[1].txt (ID = 2038) 10:01 PM: Found Spy Cookie: burstnet cookie 10:01 PM: jeff vandermeulen@burstnet[2].txt (ID = 2336) 10:01 PM: Found Spy Cookie: gostats cookie 10:01 PM: jeff vandermeulen@c3.gostats[2].txt (ID = 2748) 10:01 PM: jeff vandermeulen@casinogambling.about[1].txt (ID = 2038) 10:01 PM: jeff vandermeulen@cbs.112.2o7[1].txt (ID = 1958) 10:01 PM: Found Spy Cookie: ccbill cookie 10:01 PM: jeff vandermeulen@ccbill[2].txt (ID = 2369) 10:01 PM: Found Spy Cookie: cd freaks cookie 10:01 PM: jeff vandermeulen@cdfreaks[2].txt (ID = 2370) 10:01 PM: Found Spy Cookie: centrport net cookie 10:01 PM: jeff vandermeulen@centrport[1].txt (ID = 2374) 10:01 PM: jeff vandermeulen@club.cdfreaks[1].txt (ID = 2371) 10:01 PM: jeff vandermeulen@cnn.122.2o7[1].txt (ID = 1958) 10:01 PM: jeff vandermeulen@compsimgames.about[1].txt (ID = 2038) 10:01 PM: Found Spy Cookie: clickzs cookie 10:01 PM: jeff vandermeulen@cz3.clickzs[2].txt (ID = 2413) 10:01 PM: jeff vandermeulen@cz4.clickzs[2].txt (ID = 2413) 10:01 PM: Found Spy Cookie: wtlive.com cookie 10:01 PM: jeff vandermeulen@dcstest.wtlive[2].txt (ID = 3700) 10:01 PM: Found Spy Cookie: desktop kazaa cookie 10:01 PM: jeff vandermeulen@desktop.kazaa[2].txt (ID = 2515) 10:01 PM: jeff vandermeulen@dist.belnk[1].txt (ID = 2293) 10:01 PM: jeff vandermeulen@educationsuccess.122.2o7[1].txt (ID = 1958) 10:01 PM: jeff vandermeulen@espn.go[1].txt (ID = 2729) 10:01 PM: Found Spy Cookie: wegcash cookie 10:01 PM: jeff vandermeulen@free.wegcash[1].txt (ID = 3682) 10:01 PM: Found Spy Cookie: gamespy cookie 10:01 PM: jeff vandermeulen@gamespy[1].txt (ID = 2719) 10:01 PM: jeff vandermeulen@gostats[2].txt (ID = 2747) 10:01 PM: jeff vandermeulen@go[2].txt (ID = 2728) 10:01 PM: Found Spy Cookie: starware.com cookie 10:01 PM: jeff vandermeulen@h.starware[1].txt (ID = 3442) 10:01 PM: Found Spy Cookie: hypertracker.com cookie 10:01 PM: jeff vandermeulen@hypertracker[1].txt (ID = 2817) 10:01 PM: Found Spy Cookie: screensavers.com cookie 10:01 PM: jeff vandermeulen@i.screensavers[2].txt (ID = 3298) 10:01 PM: Found Spy Cookie: infospace cookie 10:01 PM: jeff vandermeulen@infospace[1].txt (ID = 2865) 10:01 PM: Found Spy Cookie: kinghost cookie 10:01 PM: jeff vandermeulen@kinghost[2].txt (ID = 2903) 10:01 PM: jeff vandermeulen@movies.about[1].txt (ID = 2038) 10:01 PM: jeff vandermeulen@movies.go[1].txt (ID = 2729) 10:01 PM: Found Spy Cookie: touchclarity cookie 10:01 PM: jeff vandermeulen@msn.touchclarity[1].txt (ID = 3566) 10:01 PM: Found Spy Cookie: aptimus cookie 10:01 PM: jeff vandermeulen@network.aptimus[2].txt (ID = 2235) 10:01 PM: Found Spy Cookie: partypoker cookie 10:01 PM: jeff vandermeulen@partypoker[1].txt (ID = 3111) 10:01 PM: Found Spy Cookie: paypopup cookie 10:01 PM: jeff vandermeulen@paypopup[1].txt (ID = 3119) 10:01 PM: Found Spy Cookie: pcstats.com cookie 10:01 PM: jeff vandermeulen@pcstats[1].txt (ID = 3125) 10:01 PM: Found Spy Cookie: overture cookie 10:01 PM: jeff vandermeulen@perf.overture[1].txt (ID = 3106) 10:01 PM: Found Spy Cookie: pricegrabber cookie 10:01 PM: jeff vandermeulen@pricegrabber[1].txt (ID = 3185) 10:01 PM: jeff vandermeulen@riptownmedia.122.2o7[1].txt (ID = 1958) 10:01 PM: Found Spy Cookie: rn11 cookie 10:01 PM: jeff vandermeulen@rn11[2].txt (ID = 3261) 10:01 PM: Found Spy Cookie: adjuggler cookie 10:01 PM: jeff vandermeulen@rotator.adjuggler[1].txt (ID = 2071) 10:01 PM: jeff vandermeulen@rsi.abc.go[1].txt (ID = 2729) 10:01 PM: jeff vandermeulen@rsi.espn.go[1].txt (ID = 2729) 10:01 PM: Found Spy Cookie: web-stat cookie 10:01 PM: jeff vandermeulen@server3.web-stat[1].txt (ID = 3649) 10:01 PM: jeff vandermeulen@sports.espn.go[1].txt (ID = 2729) 10:01 PM: jeff vandermeulen@vgstrategies.about[1].txt (ID = 2038) 10:01 PM: jeff vandermeulen@vip.clickzs[2].txt (ID = 2413) 10:01 PM: Found Spy Cookie: sympaticoca cookie 10:01 PM: jeff vandermeulen@visit.sympatico[1].txt (ID = 3484) 10:01 PM: Found Spy Cookie: webpower cookie 10:01 PM: jeff vandermeulen@webpower[1].txt (ID = 3660) 10:01 PM: Found Spy Cookie: affiliatefuel.com cookie 10:01 PM: jeff vandermeulen@www.affiliatefuel[1].txt (ID = 2202) 10:01 PM: Found Spy Cookie: burstbeacon cookie 10:01 PM: jeff vandermeulen@www.burstbeacon[2].txt (ID = 2335) 10:01 PM: Found Spy Cookie: myaffiliateprogram.com cookie 10:01 PM: jeff vandermeulen@www.myaffiliateprogram[2].txt (ID = 3032) 10:01 PM: jeff vandermeulen@www.screensavers[2].txt (ID = 3298) 10:01 PM: Found Spy Cookie: xiti cookie 10:01 PM: jeff vandermeulen@xiti[1].txt (ID = 3717) 10:01 PM: Found Spy Cookie: yadro cookie 10:01 PM: jeff vandermeulen@yadro[2].txt (ID = 3743) 10:01 PM: jeff vandermeulen@yieldmanager[1].txt (ID = 3749) 10:01 PM: Cookie Sweep Complete, Elapsed Time: 00:00:03 10:01 PM: Starting File Sweep 10:02 PM: Found Adware: commonname 10:02 PM: c:\windows\temp\adware (ID = -2147481214) 10:02 PM: Found Adware: bullguard popup ad 10:02 PM: c:\windows\temp\bullguard (1 subtraces) (ID = -2147476409) 10:02 PM: Found Adware: gain-supported software 10:02 PM: c:\program files\common files\cmeii (26 subtraces) (ID = -2147480946) 10:02 PM: c:\program files\common files\gmt (3102 subtraces) (ID = -2147480945) 10:02 PM: c:\program files\quick links (2 subtraces) (ID = -2147478145) 10:02 PM: c:\program files\surfaccuracy (4 subtraces) (ID = -2147478266) 10:02 PM: ysbactivex.dll (ID = 185436) 10:03 PM: Found Adware: apropos 10:03 PM: wingenerics.dll (ID = 50187) 10:03 PM: gatorstubsetup.exe (ID = 61412) 10:03 PM: uninst.exe (ID = 73428) 10:03 PM: cmediagnostics.log (ID = 61291) 10:04 PM: guninstaller.exe (ID = 61468) 10:07 PM: bulldownload.exe (ID = 52017) 10:07 PM: Found Adware: topsearch 10:07 PM: topsearch.dll (ID = 79735) 10:07 PM: fillin.wav (ID = 61352) 10:07 PM: egieengine.dll (ID = 61343) 10:07 PM: gmt.exe.manifest (ID = 61434) 10:07 PM: giocl.dll (ID = 61431) 10:07 PM: cmeiiapi.dll (ID = 61293) 10:07 PM: gioclclient.dll (ID = 61432) 10:07 PM: gappmgr.dll (ID = 61377) 10:07 PM: gdwldeng.dll (ID = 61425) 10:07 PM: gmtproxy.dll (ID = 61439) 10:07 PM: egnsengine.dll (ID = 61346) 10:07 PM: egieprocess.dll (ID = 61344) 10:07 PM: eggcengine.dll (ID = 61340) 10:07 PM: gatorres.dll (ID = 61405) 10:07 PM: appmgrgui.zip (ID = 61281) 10:07 PM: hfixcfg (ID = 61483) 10:08 PM: sacc.exe (ID = 180158) 10:08 PM: HKLM\Software\Microsoft\Windows\CurrentVersion\Run || SurfAccuracy (ID = 0) 10:08 PM: qlink32.dll (ID = 153756) 10:08 PM: saccu.exe (ID = 180136) 10:08 PM: Found Adware: ist istbar 10:08 PM: iinstall.exe (ID = 181597) 10:08 PM: preuninstallql.exe (ID = 131326) 10:08 PM: Found Adware: powerscan 10:08 PM: uninstall.exe (ID = 72675) 10:08 PM: Found Adware: internetoptimizer 10:08 PM: optimize.exe (ID = 122872) 10:08 PM: Found Adware: personal money tree 10:08 PM: pmt.exe (ID = 137597) 10:08 PM: b6e2d.tmp (ID = 153752) 10:08 PM: gator.log (ID = 61386) 10:08 PM: mepcme.dat (ID = 61517) 10:08 PM: gatorsupportinfo.txt (ID = 61414) 10:08 PM: bundle.inf (ID = 61287) 10:08 PM: q0tasjbqbgaaaleq-tobgnpj.gdt2 (ID = 61574) 10:08 PM: odm.cfg (ID = 61553) 10:08 PM: File Sweep Complete, Elapsed Time: 00:06:59 10:08 PM: Full Sweep has completed. Elapsed time 00:09:23 10:08 PM: Traces Found: 3839 10:09 PM: Removal process initiated 10:09 PM: Quarantining All Traces: ist istbar 10:09 PM: Quarantining All Traces: apropos 10:09 PM: apropos is in use. It will be removed on reboot. 10:09 PM: wingenerics.dll is in use. It will be removed on reboot. 10:09 PM: Quarantining All Traces: commonname 10:09 PM: Quarantining All Traces: gain-supported software 10:10 PM: Quarantining All Traces: internetoptimizer 10:10 PM: Quarantining All Traces: altnet 10:10 PM: Quarantining All Traces: bullguard popup ad 10:13 PM: Quarantining All Traces: cydoor peer-to-peer dependency 10:13 PM: Quarantining All Traces: ist sidefind 10:13 PM: Quarantining All Traces: ist software 10:13 PM: Quarantining All Traces: ist yoursitebar 10:13 PM: Quarantining All Traces: personal money tree 10:13 PM: Quarantining All Traces: powerscan 10:13 PM: Quarantining All Traces: quicklink search toolbar 10:13 PM: Quarantining All Traces: surf accuracy 10:13 PM: surf accuracy is in use. It will be removed on reboot. 10:13 PM: sacc.exe is in use. It will be removed on reboot. 10:13 PM: Quarantining All Traces: topsearch 10:13 PM: Quarantining All Traces: 2o7.net cookie 10:13 PM: Quarantining All Traces: about cookie 10:13 PM: Quarantining All Traces: adjuggler cookie 10:13 PM: Quarantining All Traces: adknowledge cookie 10:13 PM: Quarantining All Traces: adultfriendfinder cookie 10:13 PM: Quarantining All Traces: affiliatefuel.com cookie 10:13 PM: Quarantining All Traces: aptimus cookie 10:13 PM: Quarantining All Traces: askmen cookie 10:13 PM: Quarantining All Traces: atlas dmt cookie 10:13 PM: Quarantining All Traces: atwola cookie 10:13 PM: Quarantining All Traces: azjmp cookie 10:13 PM: Quarantining All Traces: banner cookie 10:13 PM: Quarantining All Traces: belnk cookie 10:13 PM: Quarantining All Traces: bizrate cookie 10:13 PM: Quarantining All Traces: bpath cookie 10:13 PM: Quarantining All Traces: burstbeacon cookie 10:13 PM: Quarantining All Traces: burstnet cookie 10:13 PM: Quarantining All Traces: cc214142 cookie 10:13 PM: Quarantining All Traces: ccbill cookie 10:13 PM: Quarantining All Traces: cd freaks cookie 10:13 PM: Quarantining All Traces: centrport net cookie 10:13 PM: Quarantining All Traces: clickzs cookie 10:13 PM: Quarantining All Traces: desktop kazaa cookie 10:13 PM: Quarantining All Traces: falkag cookie 10:13 PM: Quarantining All Traces: gamespy cookie 10:13 PM: Quarantining All Traces: go.com cookie 10:13 PM: Quarantining All Traces: gostats cookie 10:13 PM: Quarantining All Traces: hbmediapro cookie 10:13 PM: Quarantining All Traces: hypertracker.com cookie 10:13 PM: Quarantining All Traces: inet-traffic.com cookie 10:13 PM: Quarantining All Traces: infospace cookie 10:13 PM: Quarantining All Traces: kinghost cookie 10:13 PM: Quarantining All Traces: myaffiliateprogram.com cookie 10:13 PM: Quarantining All Traces: overture cookie 10:13 PM: Quarantining All Traces: partypoker cookie 10:13 PM: Quarantining All Traces: paypopup cookie 10:13 PM: Quarantining All Traces: pcstats.com cookie 10:13 PM: Quarantining All Traces: pricegrabber cookie 10:13 PM: Quarantining All Traces: rn11 cookie 10:13 PM: Quarantining All Traces: screensavers.com cookie 10:13 PM: Quarantining All Traces: specificclick.com cookie 10:13 PM: Quarantining All Traces: starware.com cookie 10:13 PM: Quarantining All Traces: sympaticoca cookie 10:13 PM: Quarantining All Traces: touchclarity cookie 10:13 PM: Quarantining All Traces: webpower cookie 10:13 PM: Quarantining All Traces: web-stat cookie 10:13 PM: Quarantining All Traces: wegcash cookie 10:13 PM: Quarantining All Traces: wtlive.com cookie 10:13 PM: Quarantining All Traces: xiti cookie 10:13 PM: Quarantining All Traces: yadro cookie 10:13 PM: Quarantining All Traces: yieldmanager cookie 10:14 PM: Preparing to restart your computer. Please wait... 10:14 PM: Removal process completed. Elapsed time 00:04:48 ******** 9:57 PM: | Start of Session, November 13, 2005 | 9:57 PM: Spy Sweeper started 9:58 PM: Your spyware definitions have been updated. 9:59 PM: | End of Session, November 13, 2005 |

[LDTate]

Tuna.
ONLY authorized members are allowed to reply to topics in this forum. This is due to damage that can be caused by improper advice.
Please do not post your logs in someone else's thread. Start a new thread by clicking on New Topic. Do not post your problems into other open logs saying "I have the same issue, here is my log" etc. This is too confusing for everyone involved. Also, please stay with your original topic when posting follow ups.
All posts with no replies over 20 days are subject to deletion, if this happens to you, Please post a new log and a description of your problem.

[Tuna]

Tuna.
ONLY authorized members are allowed to reply to topics in this forum. This is due to damage that can be caused by improper advice.
Please do not post your logs in someone else's thread. Start a new thread by clicking on New Topic. Do not post your problems into other open logs saying "I have the same issue, here is my log" etc. This is too confusing for everyone involved. Also, please stay with your original topic when posting follow ups.
All posts with no replies over 20 days are subject to deletion, if this happens to you, Please post a new log and a description of your problem.

Yeah, sorry. I just read that a minute ago.

[LDTate]

I suggest you do this:


Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Clear "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Clear "Hide protected operating system files."
Click Apply, and then click OK.


Please do not delete anything unless instructed to.


Use Add/Remove Programs and remove: If listed.
P2P Networking
Viewpoint Manager



Run hijackthis. Hit None of the above, Click Do a System Scan Only. Put a Check in the box on the left side on these:

R3 - URLSearchHook: (no name) - _{00D6A7E7-4A97-456f-848A-3B75BF7554D7} - (no file)

O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P Networking.exe /AUTOSTART

O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE

O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe

O15 - Trusted Zone: http://www.lyricshosting.com

O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -

Optional fixes,
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

Close ALL windows and browsers except HijackThis and click "Fix checked"



Restart in Safe Mode:
Restart your computer.

Press F8 after the Power-On Self Test (POST) is done. If the Windows Advanced Options Menu does not appear, try restarting and then pressing F8 several times after the POST screen.
Choose the Safe Mode option from the Windows Advanced Options Menu then press Enter.


Open C:\Windows\Prefetch\ Delete ALL files in this folder.



Do this also if these Temp Folders are part of your OS.

Also in safe mode navigate to the C:\Windows\Temp folder. Open the Temp folder and go to Edit > Select All then Edit > Delete to delete the entire contents of the Temp folder.


Next navigate to the C:\Documents and Settings\(EVERY LISTED PROFILE USER)\Local Settings\Temp folder. Open the Temp folder and go to Edit > Select All then Edit > Delete to delete the entire contents of the Temp folder.

Finally go to Control Panel > Internet Options. On the General tab under "Temporary Internet Files" Click "Delete Files". Put a check by "Delete Offline Content" and click OK. Click on the Programs tab then click the "Reset Web Settings" button. Click Apply then OK.


Empty the Recycle Bin

Reboot and "copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at the moment.

[biggus]

Everything seems to be running as it should.

Here is the latest log file:

Logfile of HijackThis v1.99.1
Scan saved at 11:11:09 PM, on 13/11/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\WINDOWS\System32\DVDRAMSV.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\ASUS\Probe\AsusProb.exe
C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe
C:\PROGRA~1\B'SCLI~1\Win2K\BSCLIP.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2J1.EXE
C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe
C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDet.EXE
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\Winamp280\Winampa.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Creative\MediaSource\RemoteControl\RcMan.exe
C:\WINDOWS\system32\RAMASST.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Jeff VanderMeulen\My Documents\Downloads\adaware\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Probe\AsusProb.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [B'sCLiP] C:\PROGRA~1\B'SCLI~1\Win2K\BSCLIP.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [EPSON Stylus Photo R800] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2J1.EXE /P23 "EPSON Stylus Photo R800" /O6 "USB001" /M "Stylus Photo R800"
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [CTDVDDET] C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDet.EXE
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [SBDrvDet] C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe /r
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp280\Winampa.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [RemoteCenter] C:\Program Files\Creative\MediaSource\RemoteControl\RcMan.exe
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zon...kr.cab31267.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zon...nt.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\System32\DVDRAMSV.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe

[LDTate]

Good Job


Log looks good How is it running any issues?

Note: This will remove all previous Restore Points

Turn off System Restore:

On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.

Restart your computer, turn it back on.

On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Remove the Check Turn off System Restore.
Click Apply, and then click OK.

Click Start> My Computer, select the Tools menu and then Folder Options, after the new window appears select the View tab…]
This time select the: Restore Defaults
Select: Apply, and click OK




If you dont have these three programs I would recommend that you get them. Spywareblaster, Spywareguard and IESPY AD. They will add 1000's of sites to your resticted zone and block some hijacks from happening. I also have a FREE FIREWALL and FREE ANTI VIRUS if you need one.

It is critical to have both a firewall and anti virus to protect your system.

Keep your system up to date and run Adaware & Spybot, once a week works, and hopefully you will be ok from here on. Both are available below.

Safe Surfing.

[biggus]

Things a running good. I've installed the recommended programs. I appreciate you help LDTate. Keep up the superb work. biggus

[LDTate]

Great job You're more then welcome. Glad we were able to help Peace be with you

[LDTate]

Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoy...showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php