Infected

I received the following message from Microsost: Warning! Spyware detected. Attention! Your system is under control of remote computer with IP address 227.4.067.118. The remote computer has access to the following: \windows\System32; \Program Files\Internet Explorer; \My Documents\; Drive C:\ files.

I am running McAfee virus pro, spyblaster and spybots search and destroy, have updated and imunized to no avail. I immediately disconnected from the internet on this compute - another on running off the same router with 98SD isn't effected. I ran HijackThis and her is the log:
Logfile of HijackThis v1.99.1
Scan saved at 11:31:12 PM, on 12/28/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\SuperAdBlocker.com\Super Ad Blocker\SABSVC.EXE
C:\WINDOWS\system32\spoolsv.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\WINDOWS\Explorer.EXE
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\mssearchnet.exe
C:\WINDOWS\system32\nvctrl.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\WINDOWS\htpatch.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\QuickTime\qttask.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Common Files\AOL\1135135709\ee\AOLSoftware.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\Documents and Settings\The LAM\My Documents\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: HomepageBHO - {e0103cd4-d1ce-411a-b75b-4fec072867f4} - C:\WINDOWS\system32\hp9D73.tmp
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: Super Ad Blocker Toolbar - {B4B3001E-0F56-4E51-8250-BDE11547EC55} - C:\Program Files\SuperAdBlocker.com\Super Ad Blocker\sabtb.dll
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1135135709\ee\AOLSoftware.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MSKAgent.exe
O4 - Startup: Epson all-in-one Registration.lnk = E:\Titles\Ereg\EPSONREG.exe
O4 - Global Startup: hpoddt01.exe.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m…83/mcinsctl.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/m…,20/mcgdmgr.cab
O16 - DPF: {DBA230D1-8467-4e69-987E-5FAE815A3B45} -
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/aio/en/check/qdiagh.cab?326
O20 - Winlogon Notify: SABWinLogon - C:\Program Files\SuperAdBlocker.com\Super Ad Blocker\SABWINLO.DLL
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - McAfee, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Super Ad Blocker Service (SABSVC) - SuperAdBlocker.com - C:\Program Files\SuperAdBlocker.com\Super Ad Blocker\SABSVC.EXE


When I attempted to remove [ O2 - BHO: HomepageBHO - {e0103cd4-d1ce-411a-b75b-4fec072867f4} - C:\WINDOWS\system32\hp9D73.tmp ] it said there was an unexpected error and that I should contact TomCoyote.

Please help

MrCharlie…..
I did everything you asked and had good results. I did have a dilema as I could not access the internet from the infected computer. when I attempted to access any site it directed me to the following message "Your computer is infected! Dangerous malware infection was detected on you PC. The system will now download and install the most efficient antimalwareprogram….." I immediately disconnected from the internet, but not before SpyAxe v3.0 loaded.

Fortunately I have another computer running Win 98 SE on the same router which doesn't seem infected and I downloaded all the programs and updates/signature files on that computer, burned to a disk and installed as directed on the infected computer. The Panda scan detected no problems and here are the scan and log files you requested:
smitRem © log file
version 2.8

by noahdfear


Microsoft Windows XP [Version 5.1.2600]
The current date is: Mon 01/02/2006
The current time is: 17:27:45.91

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

checking for ShudderLTD key

ShudderLTD key not present!

checking for PSGuard.com key


PSGuard.com key not present!


checking for WinHound.com key


WinHound.com key not present!

spyaxe uninstaller NOT present
Winhound uninstaller NOT present
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Existing Pre-run Files


~~~ Program Files ~~~



~~~ Shortcuts ~~~

Online Security Guide.url
Security Troubleshooting.url


~~~ Favorites ~~~

Antivirus Test Online.url


~~~ system32 folder ~~~

wbeconm.dll
1024 dir
msvol.tlb
ld****.tmp
mssearchnet.exe
ncompat.tlb
nvctrl.exe
mscornet.exe


~~~ Icons in System32 ~~~

ts.ico
ot.ico


~~~ Windows directory ~~~



~~~ Drive root ~~~


~~~ Miscellaneous Files/folders ~~~




~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~



Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright© 2002-2003 [removed]
Killing PID 860 'explorer.exe'
Killing PID 860 'explorer.exe'

Starting registry repairs

Deleting files


Remaining Post-run Files


~~~ Program Files ~~~



~~~ Shortcuts ~~~

Online Security Guide.url


~~~ Favorites ~~~



~~~ system32 folder ~~~



~~~ Icons in System32 ~~~



~~~ Windows directory ~~~



~~~ Drive root ~~~



~~~ Miscellaneous Files/folders ~~~




~~~ Wininet.dll ~~~

CLEAN!

ÿþ- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

e w i d o a n t i - m a l w a r e - S c a n r e p o r t

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



+ C r e a t e d o n : 8 : 3 4 : 0 8 P M , 1 / 2 / 2 0 0 6

+ R e p o r t - C h e c k s u m : 7 7 4 C F 4 F C



+ S c a n r e s u l t :



H K L M \ S O F T W A R E \ C l a s s e s \ C L S I D \ { 2 B 9 6 D 5 C C - C 5 B 5 - 4 9 A 5 - A 6 9 D - C C 0 A 3 0 F 9 0 2 8 C } - > S p y w a r e . M i n i B u g : C l e a n e d w i t h b a c k u p

H K L M \ S O F T W A R E \ C l a s s e s \ C L S I D \ { B 5 A B 6 3 8 F - D 7 6 C - 4 1 5 B - A 8 F 2 - F 3 C E A C 5 0 2 2 1 2 } - > S p y w a r e . A p r o p o s M e d i a : C l e a n e d w i t h b a c k u p

H K L M \ S O F T W A R E \ C l a s s e s \ C L S I D \ { B C 3 3 3 1 1 6 - 6 E A 1 - 4 0 A 1 - 9 D 0 7 - E C B 1 9 2 D B 8 C E A } - > S p y w a r e . A p r o p o s M e d i a : C l e a n e d w i t h b a c k u p

H K L M \ S O F T W A R E \ C l a s s e s \ I n t e r f a c e \ { A A 4 9 3 9 C 3 - D E C A - 4 A 4 8 - A 4 5 4 - 9 7 C D 5 8 7 C 0 E F 5 } - > S p y w a r e . I S T B a r : C l e a n e d w i t h b a c k u p

H K L M \ S O F T W A R E \ C l a s s e s \ I n t e r f a c e \ { B C 3 3 3 1 1 6 - 6 E A 1 - 4 0 A 1 - 9 D 0 7 - E C B 1 9 2 D B 8 C E A } - > S p y w a r e . A p r o p o s M e d i a : C l e a n e d w i t h b a c k u p

H K L M \ S O F T W A R E \ C l a s s e s \ I n t e r f a c e \ { E E E 4 A 2 E 5 - 9 F 5 6 - 4 3 2 F - A 6 E D - F 6 F 6 2 5 B 5 5 1 E 0 } - > D i a l e r . G e n e r i c : C l e a n e d w i t h b a c k u p

H K L M \ S O F T W A R E \ C l a s s e s \ P R O T O C O L S \ N a m e - S p a c e H a n d l e r \ r e s - > S p y w a r e . W e b S e a r c h : C l e a n e d w i t h b a c k u p

H K L M \ S O F T W A R E \ M i c r o s o f t \ W i n d o w s \ C u r r e n t V e r s i o n \ p o l i c i e s \ A M e O p t - > S p y w a r e . I n t e r n e t O p t i m i z e r : C l e a n e d w i t h b a c k u p

C : \ D o c u m e n t s a n d S e t t i n g s \ T h e L A M \ M y D o c u m e n t s \ b a c k u p s \ b a c k u p - 2 0 0 5 1 2 2 8 - 2 3 3 3 2 7 - 6 6 9 . d l l - > D o w n l o a d e r . Z l o b . d k : C l e a n e d w i t h b a c k u p

C : \ D o c u m e n t s a n d S e t t i n g s \ T h e L A M \ M y D o c u m e n t s \ b a c k u p s \ b a c k u p - 2 0 0 5 1 2 2 8 - 2 3 3 5 1 0 - 8 4 7 . d l l - > D o w n l o a d e r . Z l o b . d k : C l e a n e d w i t h b a c k u p

C : \ P r o g r a m F i l e s \ A W S \ W e a t h e r B u g \ M i n i B u g T r a n s p o r t e r . d l l - > S p y w a r e . W h e a t e r b u g : C l e a n e d w i t h b a c k u p

C : \ P r o g r a m F i l e s \ H i j a c k T h i s \ b a c k u p s \ b a c k u p - 2 0 0 6 0 1 0 2 - 1 7 2 4 4 6 - 5 7 8 . d l l - > D o w n l o a d e r . Z l o b . d r : C l e a n e d w i t h b a c k u p

C : \ P r o g r a m F i l e s \ S u p e r A d B l o c k e r . c o m \ S u p e r A d B l o c k e r \ Q u a r a n t i n e \ Q u a r a n t i n e - 1 2 - 0 1 - 2 0 0 5 - 1 2 - 5 0 - 3 6 . S B U / { 8 1 6 F 9 1 5 6 - 6 A D 4 - 4 E F 6 - B 4 7 B - 6 6 6 E 6 1 D 9 8 9 D 1 } - > S p y w a r e . W i n A D : C l e a n e d w i t h b a c k u p

C : \ P r o g r a m F i l e s \ S u p e r A d B l o c k e r . c o m \ S u p e r A d B l o c k e r \ Q u a r a n t i n e \ Q u a r a n t i n e - 1 2 - 0 1 - 2 0 0 5 - 1 2 - 5 0 - 3 6 . S B U / { 9 8 8 F 6 3 E E - B 3 8 8 - 4 B C 0 - 9 6 A A - 1 A 5 C 4 A 2 A 0 8 2 E } - > S p y w a r e . M e d i a P a s s : C l e a n e d w i t h b a c k u p

G : \ M y M u s i c \ D a d ' s \ S e a n s f i l e s \ F u n n y \ v i a g r a . e x e - > N o t - A - V i r u s . J o k e . V i a g r a : C l e a n e d w i t h b a c k u p

G : \ M y M u s i c \ D a d ' s \ S e a n s f i l e s \ M i s c e l l a n e o u s P i c t u r e s & M o v i e s \ v i a g r a . e x e - > N o t - A - V i r u s . J o k e . V i a g r a : C l e a n e d w i t h b a c k u p





: : R e p o r t E n d

Logfile of HijackThis v1.99.1
Scan saved at 9:57:54 PM, on 1/2/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\SuperAdBlocker.com\Super Ad Blocker\SABSVC.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\WINDOWS\Explorer.EXE
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\WINDOWS\htpatch.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\SOUNDMAN.EXE
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\Program Files\Common Files\AOL\1135135709\ee\AOLSoftware.exe
C:\WINDOWS\system32\ctfmon.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: Super Ad Blocker Toolbar - {B4B3001E-0F56-4E51-8250-BDE11547EC55} - C:\Program Files\SuperAdBlocker.com\Super Ad Blocker\sabtb.dll
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1135135709\ee\AOLSoftware.exe
O4 - HKCU\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MSKAgent.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Epson all-in-one Registration.lnk = E:\Titles\Ereg\EPSONREG.exe
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m…83/mcinsctl.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/m…,20/mcgdmgr.cab
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/aio/en/check/qdiagh.cab?326
O20 - Winlogon Notify: SABWinLogon - C:\Program Files\SuperAdBlocker.com\Super Ad Blocker\SABWINLO.DLL
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - McAfee, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Super Ad Blocker Service (SABSVC) - SuperAdBlocker.com - C:\Program Files\SuperAdBlocker.com\Super Ad Blocker\SABSVC.EXE

** I have a couple of questions - —–
What programs should I leave on my computer now?

How did the infection most likely get on the computer and how can I keep from recurring infections?

Because I was initially given an IP address of 227.4.067.118 of the remote comuter controlling mine, is there any way of tracking / reporting / doing anything to this person?

What do you suggest I do with my other computer running Win 98 SE from the same router?

Thank you so much for your help, and hopefully the scan information looks good now.

Daklingon

Welcome to the forum. Please don't skip any steps!

Please make sure you have system restore running and have a restore point that you can go back to in case something goes wrong during the fix.
XP system restore

Please do this for me…

Download smitRem.exe© noahdfear and save the file to your desktop.
Double click on the file to extract it to it's own folder on the desktop.

Place a shortcut to Panda ActiveScan on your desktop.

Please download the trial version of Ewido Security Suite here:
http://www.ewido.net/en/download/

• When installing, under "Additional Options" uncheck "Install background guard" and "Install scan via context menu".
  
  
• When you run ewido for the first time, you will get a warning "Database could not be found!". Click OK. We will fix this in a moment.
  
  
• From the main ewido screen, click on update in the left menu, then click the Start update button.
  
  
• After the update finishes (the status bar at the bottom will display "Update successful")
  
  
• Exit Ewido. DO NOT scan yet.
  
  
• Tutorial if needed

Download and install AdAware SE Personel, follow these setup instructions:
Ad-Aware SE Setup
Don't run it yet!

Clean out temporary and TIF files. Go to Start > Run and type in the box: cleanmgr. Let it scan your system for files to remove. Make sure these 3 are checked and then press *ok* to remove:

• Temporary Files
  
  
• Temporary Internet Files
  
  
• Recycle Bin

Next, please reboot your computer in SafeMode by doing the following:

• Restart your computer
  
  
• After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
  
  
• Instead of Windows loading as normal, a menu should appear
  
  
• Select the first option, to run Windows in Safe Mode.

Close ALL programs down, leaving ONLY HijackThis running - Click Scan and…..
Place a check against the following items:

===================================================

O2 - BHO: HomepageBHO - {e0103cd4-d1ce-411a-b75b-4fec072867f4} - C:\WINDOWS\system32\hp9D73.tmp
O16 - DPF: {DBA230D1-8467-4e69-987E-5FAE815A3B45} -

===================================================

Click on Fix Checked and exit HijackThis.

Delete these files or folders if found:

C:\Program Files\SpyAxe

Open the smitRem folder, then double click the RunThis.bat file to start the tool. Follow the prompts on screen.
Wait for the tool to complete and disk cleanup to finish.

The tool will create a log named smitfiles.txt in the root of your drive, eg; Local Disk C: or partition where your operating system is installed. Please post that log along with all others requested in your next reply.

Open Ad-aware and do a full scan. Remove all it finds.

Open Ewido

• Click on scanner
  
  
• Click Complete System Scan
  
  
• Let the program scan the machine

While the scan is in progress you will be prompted to clean the first infected file it finds. Choose "remove", then put a check next to "Perform action on all infections" in the left corner of the box so you don't have to sit and watch Ewido the whole time. Click OK.

Once the scan has completed, there will be a button located on the bottom of the screen named Save report

• Click Save report
  
  
• Save the report to your desktop
  
  
• Exit Ewido

Next go to Control Panel click Display > Desktop > Customize Desktop > Web > Uncheck "Security Info" if present.

Reboot back into Windows and click the Panda ActiveScan shortcut.
- Once you are on the Panda site click the Scan your PC button
- A new window will open…click the Check Now button
- Enter your Country
- Enter your State/Province
- Enter your e-mail address and click send
- Select either Home User or Company
- Click the big Scan Now button
- If it wants to install an ActiveX component allow it
- It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
- When download is complete, click on Local Disks to start the scan
- When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location.
Post the contents of the Panda scan report, along with a new HijackThis Log, the contents of smitfiles.txt and the Ewido Log by using Add Reply.

If you're left with a white screen, move your mouse to the top right corner, where the X button usually is and one should appear (kind of in a "hidden taskbar" sort of manner) Click it and the white screen goes away!

Good Luck , MrC