8 replies to this topic

[goldeneye]

Hi there!

I've been experiencing some problems with adware in my computer. I've already used Spybot, adaware, norton and counterspy to try to fix the problem. They find a lot of things, they say they deleted them but the problem keeps on. However, some have disappeared, for example, a bar on the top of the screen. The spyware tries to sell an anti-spywre program called Spysherif.

Here my hijackthis log:

Logfile of HijackThis v1.99.1
Scan saved at 23:17:22, on 30-12-2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programas\Ficheiros comuns\Symantec Shared\ccSetMgr.exe
C:\Programas\Ficheiros comuns\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programas\Sunbelt Software\CounterSpy\Consumer\sunThreatEngine.exe
C:\WINDOWS\system32\devldr32.exe
C:\PROGRA~1\NORTON~1\NORTON~4\GHOSTS~2.EXE
C:\Programas\Ficheiros comuns\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Programas\Norton SystemWorks\Norton Antivirus\navapsvc.exe
C:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE
C:\Programas\Norton SystemWorks\Norton Antivirus\SAVScan.exe
C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\system32\svchost.exe
C:\Programas\Ficheiros comuns\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Programas\Sunbelt Software\CounterSpy\Consumer\SunProtectionServer.exe
C:\Programas\CyberLink\PowerDVD\PDVDServ.exe
C:\Programas\HP\HP Software Update\HPWuSchd.exe
C:\Programas\HP\hpcoretech\hpcmpmgr.exe
C:\Programas\Conceptronic\Conceptronic 54Mbps Wireless Utility\WLANmon.exe
C:\Programas\ANI\ANIWZCS2 Service\WZCSLDR2.exe
C:\WINDOWS\system32\AVWLPSTA.EXE
C:\Programas\Ficheiros comuns\Real\Update_OB\realsched.exe
C:\Programas\D-Tools\daemon.exe
C:\Programas\Sunbelt Software\CounterSpy\Consumer\sunserver.exe
C:\Programas\Ficheiros comuns\Symantec Shared\ccApp.exe
C:\Programas\Norton SystemWorks\Norton Ghost\GhostStartTrayApp.exe
C:\Programas\Norton SystemWorks\Password Manager\AcctMgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programas\Messenger\msmsgs.exe
C:\Programas\MSN Messenger\MsnMsgr.Exe
C:\Programas\HP\Digital Imaging\bin\hpqtra08.exe
C:\Programas\Netcount\Netcount.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programas\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Luis Silva\Ambiente de trabalho\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\iaxgy.dll/sp.html#93256%resultposition.net
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\iaxgy.dll/sp.html#93256%resultposition.net
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\iaxgy.dll/sp.html#93256%resultposition.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\iaxgy.dll/sp.html#93256%resultposition.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\iaxgy.dll/sp.html#93256%resultposition.net
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\iaxgy.dll/sp.html#93256%resultposition.net
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\iaxgy.dll/sp.html#93256%resultposition.net
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hiperligações
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: UserInit=C:\WINDOWS\regedit /s C:\pav.reg,C:\WINDOWS\system32\pavdr.exe,C:\WINDOWS\system32\userinit.exe,
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programas\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Class - {10123428-A96D-94DF-C71E-72AD4E1826F7} - C:\WINDOWS\d3ca.dll (file missing)
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] C:\Programas\CyberLink\PowerDVD\PDVDServ.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Programas\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Programas\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [DXDllRegExe] dxdllreg.exe
O4 - HKLM\..\Run: [Conceptronic Conceptronic 54Mbps Wireless Utility] C:\Programas\Conceptronic\Conceptronic 54Mbps Wireless Utility\WLANmon.exe
O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Programas\ANI\ANIWZCS2 Service\WZCSLDR2.exe
O4 - HKLM\..\Run: [AVWLPSTA.exe] AVWLPSTA.EXE START
O4 - HKLM\..\Run: [TkBellExe] "C:\Programas\Ficheiros comuns\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Programas\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [ieku32.exe] C:\WINDOWS\system32\ieku32.exe
O4 - HKLM\..\Run: [6.tmp] C:\DOCUME~1\LUISSI~1\DEFINI~1\Temp\6.tmp.exe
O4 - HKLM\..\Run: [7.tmp] C:\DOCUME~1\LUISSI~1\DEFINI~1\Temp\7.tmp.exe
O4 - HKLM\..\Run: [6.tmp.exe] C:\DOCUME~1\LUISSI~1\DEFINI~1\Temp\6.tmp.exe
O4 - HKLM\..\Run: [7.tmp.exe] C:\DOCUME~1\LUISSI~1\DEFINI~1\Temp\7.tmp.exe
O4 - HKLM\..\Run: [addfw32.exe] C:\WINDOWS\system32\addfw32.exe
O4 - HKLM\..\Run: [SunServer] C:\Programas\Sunbelt Software\CounterSpy\Consumer\sunserver.exe
O4 - HKLM\..\Run: [ccApp] "C:\Programas\Ficheiros comuns\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [GhostStartTrayApp] C:\Programas\Norton SystemWorks\Norton Ghost\GhostStartTrayApp.exe
O4 - HKLM\..\Run: [AcctMgr] C:\Programas\Norton SystemWorks\Password Manager\AcctMgr.exe /startup
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programas\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programas\MSN Messenger\MsnMsgr.Exe" /background
O4 - Startup: Netcount.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Programas\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programas\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programas\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programas\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Programas\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.co...ad/MsnPUpld.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O23 - Service: Network Security Service (NSS) ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\system32\netil32.exe (file missing)
O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Alpha Networks Inc. - C:\Programas\ANI\ANIWZCS2 Service\ANIWZCSdS.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programas\Ficheiros comuns\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Programas\Ficheiros comuns\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programas\Ficheiros comuns\Symantec Shared\ccSetMgr.exe
O23 - Service: GhostStartService - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~4\GHOSTS~2.EXE
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Programas\Norton SystemWorks\Norton Antivirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: SAVScan - Symantec Corporation - C:\Programas\Norton SystemWorks\Norton Antivirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHEI~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Programas\Ficheiros comuns\Symantec Shared\SNDSrvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Programas\Ficheiros comuns\Symantec Shared\CCPD-LC\symlcsvc.exe

Hope you can help me!
Thanks in advance!
Happy new 2006

[LDTate]

Hello goldeneye,

Please download this tool called 'About:Buster':

http://www.malwareby...AboutBuster.zip

Unzip it to your desktop.

DO NOT relaunch Internet Explorer at any point during this.


Unzip AboutBuster to the Desktop and have it ready to run, but don't run it yet.

Now sign off the internet and remain offline until this procedure is complete. Copy these instructions to notepad and save them on your desktop for easy access.


Before restarting run aboutbuster. Again remain offline. Double click aboutbuster.exe, click OK, click Start, then click OK. This will scan your computer for the bad files and delete them.

Once the tool is done scanning, copy the log and save it to paste back here in your thread.

Restart your computer,

Now run about:Buster again just to be sure it got everything.

Make a copy of the log it creates again.

Reboot and post the 2 about buster logs and a fresh HijackThis log.

[goldeneye]

Thanks for helping

Here's the first A:B log:

AboutBuster 6.0
Scan started on [06-01-2006] at [19:42:28]
-------------------------------------------------------------
Internet Explorer Instances Terminated!
HomeSearch Service stopped if present
-------------------------------------------------------------
Removed Stream! C:\WINDOWS\Ascd_tmp.ini:brgqiq
Removed Stream! C:\WINDOWS\Bruma.bmp:uszwka
Removed Stream! C:\WINDOWS\clock.avi:issni
Removed Stream! C:\WINDOWS\KB905414.log:fmcwt
Removed Stream! C:\WINDOWS\msdfmap.ini:aqusc
Removed Stream! C:\WINDOWS\msdfmap.ini:gztgcp
Removed Stream! C:\WINDOWS\netfxocm.log:jmgfa
Removed Stream! C:\WINDOWS\netfxocm.log:zaetwa
Removed Stream! C:\WINDOWS\ocmsn.log:tfokzw
Removed Stream! C:\WINDOWS\ODBCINST.INI:tibeg
Removed Stream! C:\WINDOWS\oobeact.log:eghytg
Removed Stream! C:\WINDOWS\Plumas.bmp:nocvqt
Removed Stream! C:\WINDOWS\regopt.log:pmbax
Removed Stream! C:\WINDOWS\winnt.bmp:pnpow
Removed Stream! C:\WINDOWS\winnt256.bmp:oeqlam
Removed Stream! C:\WINDOWS\_default.pif:fwanqi
Removed Stream! C:\WINDOWS\_default.pif:jrvdog
Removed Stream! C:\WINDOWS\_default.pif:nwhavg
Removed Stream! C:\WINDOWS\_default.pif:otmoa
Removed Stream! C:\WINDOWS\_default.pif:qydymd
-------------------------------------------------------------
Removed File! : C:\WINDOWS\iaxgy.dll
Removed File! : C:\WINDOWS\iprk32.dll
Removed File! : C:\WINDOWS\rbwyy.log
Removed File! : C:\WINDOWS\zrfcr.dll
Removed File! : C:\WINDOWS\system32\javase32.exe
Removed File! : C:\WINDOWS\system32\pvbfs.txt
Removed File! : C:\WINDOWS\system32\spwdr.dat
Removed File! : C:\WINDOWS\system32\wrsth.log
-------------------------------------------------------------
Removed Temp Files
Internet Explorer Settings Reset!
-------------------------------------------------------------
Scan was COMPLETED SUCCESSFULLY at 19:47:39

******************************
The second, after rebboting:

AboutBuster 6.0
Scan started on [06-01-2006] at [19:58:04]
-------------------------------------------------------------
Internet Explorer Instances Terminated!
HomeSearch Service stopped if present
-------------------------------------------------------------
No Ads Found!
-------------------------------------------------------------
No Files Found!
-------------------------------------------------------------
Scan was COMPLETED SUCCESSFULLY at 20:04:08

*******************************

And a hijckthis log:
Logfile of HijackThis v1.99.1
Scan saved at 20:08:00, on 06-01-2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programas\Ficheiros comuns\Symantec Shared\ccSetMgr.exe
C:\Programas\Ficheiros comuns\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\NORTON~1\NORTON~4\GHOSTS~2.EXE
C:\Programas\Ficheiros comuns\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Programas\Norton SystemWorks\Norton Antivirus\navapsvc.exe
C:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE
C:\Programas\Norton SystemWorks\Norton Antivirus\SAVScan.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\system32\svchost.exe
C:\Programas\Ficheiros comuns\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\devldr32.exe
C:\Programas\Sunbelt Software\CounterSpy\Consumer\sunThreatEngine.exe
C:\Programas\Sunbelt Software\CounterSpy\Consumer\SunProtectionServer.exe
C:\Programas\CyberLink\PowerDVD\PDVDServ.exe
C:\Programas\HP\HP Software Update\HPWuSchd.exe
C:\Programas\HP\hpcoretech\hpcmpmgr.exe
C:\Programas\Conceptronic\Conceptronic 54Mbps Wireless Utility\WLANmon.exe
C:\Programas\ANI\ANIWZCS2 Service\WZCSLDR2.exe
C:\WINDOWS\system32\AVWLPSTA.EXE
C:\Programas\Ficheiros comuns\Real\Update_OB\realsched.exe
C:\Programas\D-Tools\daemon.exe
C:\Programas\Sunbelt Software\CounterSpy\Consumer\sunserver.exe
C:\Programas\Ficheiros comuns\Symantec Shared\ccApp.exe
C:\Programas\Norton SystemWorks\Norton Ghost\GhostStartTrayApp.exe
C:\Programas\Norton SystemWorks\Password Manager\AcctMgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programas\Messenger\msmsgs.exe
C:\Programas\MSN Messenger\MsnMsgr.Exe
C:\Programas\HP\Digital Imaging\bin\hpqtra08.exe
C:\Programas\Netcount\Netcount.exe
C:\Documents and Settings\Luis Silva\Ambiente de trabalho\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\iaxgy.dll/sp.html#93256%resultposition.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\iaxgy.dll/sp.html#93256%resultposition.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\iaxgy.dll/sp.html#93256%resultposition.net
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\iaxgy.dll/sp.html#93256%resultposition.net
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hiperligações
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: UserInit=C:\WINDOWS\regedit /s C:\pav.reg,C:\WINDOWS\system32\pavdr.exe,C:\WINDOWS\system32\userinit.exe,
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programas\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Class - {10123428-A96D-94DF-C71E-72AD4E1826F7} - C:\WINDOWS\d3ca.dll (file missing)
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] C:\Programas\CyberLink\PowerDVD\PDVDServ.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Programas\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Programas\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [DXDllRegExe] dxdllreg.exe
O4 - HKLM\..\Run: [Conceptronic Conceptronic 54Mbps Wireless Utility] C:\Programas\Conceptronic\Conceptronic 54Mbps Wireless Utility\WLANmon.exe
O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Programas\ANI\ANIWZCS2 Service\WZCSLDR2.exe
O4 - HKLM\..\Run: [AVWLPSTA.exe] AVWLPSTA.EXE START
O4 - HKLM\..\Run: [TkBellExe] "C:\Programas\Ficheiros comuns\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Programas\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [ieku32.exe] C:\WINDOWS\system32\ieku32.exe
O4 - HKLM\..\Run: [6.tmp] C:\DOCUME~1\LUISSI~1\DEFINI~1\Temp\6.tmp.exe
O4 - HKLM\..\Run: [7.tmp] C:\DOCUME~1\LUISSI~1\DEFINI~1\Temp\7.tmp.exe
O4 - HKLM\..\Run: [addfw32.exe] C:\WINDOWS\system32\addfw32.exe
O4 - HKLM\..\Run: [SunServer] C:\Programas\Sunbelt Software\CounterSpy\Consumer\sunserver.exe
O4 - HKLM\..\Run: [ccApp] "C:\Programas\Ficheiros comuns\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [GhostStartTrayApp] C:\Programas\Norton SystemWorks\Norton Ghost\GhostStartTrayApp.exe
O4 - HKLM\..\Run: [AcctMgr] C:\Programas\Norton SystemWorks\Password Manager\AcctMgr.exe /startup
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programas\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programas\MSN Messenger\MsnMsgr.Exe" /background
O4 - Startup: Netcount.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Programas\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programas\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programas\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programas\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Programas\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.co...ad/MsnPUpld.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Alpha Networks Inc. - C:\Programas\ANI\ANIWZCS2 Service\ANIWZCSdS.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programas\Ficheiros comuns\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Programas\Ficheiros comuns\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programas\Ficheiros comuns\Symantec Shared\ccSetMgr.exe
O23 - Service: GhostStartService - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~4\GHOSTS~2.EXE
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Programas\Norton SystemWorks\Norton Antivirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: SAVScan - Symantec Corporation - C:\Programas\Norton SystemWorks\Norton Antivirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHEI~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Programas\Ficheiros comuns\Symantec Shared\SNDSrvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Programas\Ficheiros comuns\Symantec Shared\CCPD-LC\symlcsvc.exe


Again, thanks for helping me!

[LDTate]

First of all, I want you to download and install another browser, because for the moment I strongly suggest NOT to use Internet Explorer, because everytime you open it, new malware is getting downloaded.
So, I want you to use Firefox instead to browse the web.
When your system is clean again, you can use your IE again.
Here you can find firefox to download: http://www.mozilla.o...oducts/firefox/

* We will also be using AboutBuster again.
Do not use it yet.

* Download and install CCleaner
http://www.ccleaner.com/
Do not use it yet.

* Download CWShredder. Don't let it run yet!
http://cwshredder.ne.../CWShredder.exe

* Download this regfix: HSfix
http://users.pandora...tools/HSfix.zip
Unzip it and place it on your desktop, don't use it yet!

* Please download the trial version of ewido anti-malware 3.5 here:
http://www.ewido.net/en/download
Install it, and update the definitions to the newest files. Do NOT run a scan yet.

°First, we will make your hidden files and folders visible.
* Click Start.
* Open My Computer.
* Select the Tools menu and click Folder Options.
* Select the View Tab.
* Under the Hidden files and folders heading select Show hidden files and folders.
* Uncheck the Hide protected operating system files (recommended) option.
* Uncheck the Hide file extensions for known file types.
* Click Yes to confirm.
* Click OK.

open notepad and copy and paste next bold in it:
(do not forget to copy and paste REGEDIT4 in it!)

REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

Save this as fix.reg , choose to save as *all files and place it on your desktop.


*Please reboot your system into SAFE MODE.
°To get into the Windows XP Safe mode as the computer is booting press and hold your "F8 Key" which should bring up the "Windows Advanced Options Menu". Use your arrow keys to move to "Safe Mode" and press your Enter key.

Doubleclick on fix.reg you made before and when it asks you if you want to add the contents to the registry, click yes/ok


*Start hijackthis and click scan and put a checkmark next to the following items:

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\iaxgy.dll/sp.html#93256%resultposition.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\iaxgy.dll/sp.html#93256%resultposition.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\iaxgy.dll/sp.html#93256%resultposition.net
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\iaxgy.dll/sp.html#93256%resultposition.net
R3 - Default URLSearchHook is missing
O2 - BHO: Class - {10123428-A96D-94DF-C71E-72AD4E1826F7} - C:\WINDOWS\d3ca.dll (file missing)
O4 - HKLM\..\Run: [ieku32.exe] C:\WINDOWS\system32\ieku32.exe
O4 - HKLM\..\Run: [6.tmp] C:\DOCUME~1\LUISSI~1\DEFINI~1\Temp\6.tmp.exe
O4 - HKLM\..\Run: [7.tmp] C:\DOCUME~1\LUISSI~1\DEFINI~1\Temp\7.tmp.exe
O4 - HKLM\..\Run: [addfw32.exe] C:\WINDOWS\system32\addfw32.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programas\Messenger\msmsgs.exe" /background
O4 - Global Startup: Microsoft Office.lnk = C:\Programas\Microsoft Office\Office10\OSA.EXE

*Close all open windows except hijackthis and click 'Fix Checked'.



*Start Aboutbuster and let it scan. When the scan is done and you choose exit, it will automatically create a log in the same folder where aboutbuster is in.

*Start Cwshredder and click FIX

* Doubleclick on HSfix you downloaded earlier before which is present on your desktop and when it asks you if you want to add the contents to the registry, click yes/ok

* Still in safe mode Run Ccleaner and click Run Cleaner (bottom right)

* Now open ewido anti-malware 3.5
* click on the Scanner run a full scan and let it clean everything it finds. Save the logfile from the scan.

Close Ewido

*Go to start>Control Panel>Internet Options>tab programs> and click restore websettings.

* Reboot your PC back to normal.

*Post a new hijackthis-log + log from ewido and log from aboutbuster which you'll find in the aboutbuster-folder

[goldeneye]

I did everything you said and i'm using firefox now.

Here's hijhackthis log:

Logfile of HijackThis v1.99.1
Scan saved at 19:43:50, on 07-01-2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programas\Ficheiros comuns\Symantec Shared\ccSetMgr.exe
C:\Programas\Ficheiros comuns\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programas\ewido anti-malware\ewidoctrl.exe
C:\Programas\ewido anti-malware\ewidoguard.exe
C:\Programas\CyberLink\PowerDVD\PDVDServ.exe
C:\Programas\HP\HP Software Update\HPWuSchd.exe
C:\Programas\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\system32\devldr32.exe
C:\Programas\Conceptronic\Conceptronic 54Mbps Wireless Utility\WLANmon.exe
C:\Programas\ANI\ANIWZCS2 Service\WZCSLDR2.exe
C:\WINDOWS\system32\AVWLPSTA.EXE
C:\Programas\Ficheiros comuns\Real\Update_OB\realsched.exe
C:\Programas\D-Tools\daemon.exe
C:\Programas\Ficheiros comuns\Symantec Shared\ccApp.exe
C:\Programas\Norton SystemWorks\Norton Ghost\GhostStartTrayApp.exe
C:\PROGRA~1\NORTON~1\NORTON~4\GHOSTS~2.EXE
C:\Programas\Norton SystemWorks\Password Manager\AcctMgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programas\Ficheiros comuns\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Programas\Messenger\msmsgs.exe
C:\Programas\Norton SystemWorks\Norton Antivirus\navapsvc.exe
C:\Programas\MSN Messenger\MsnMsgr.Exe
C:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE
C:\Programas\HP\Digital Imaging\bin\hpqtra08.exe
C:\Programas\Norton SystemWorks\Norton Antivirus\SAVScan.exe
C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
C:\Programas\Netcount\Netcount.exe
C:\WINDOWS\system32\svchost.exe
C:\Programas\Ficheiros comuns\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programas\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Luis Silva\Ambiente de trabalho\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hiperligações
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: UserInit=C:\WINDOWS\regedit /s C:\pav.reg,C:\WINDOWS\system32\pavdr.exe,C:\WINDOWS\system32\userinit.exe,
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programas\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] C:\Programas\CyberLink\PowerDVD\PDVDServ.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Programas\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Programas\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [DXDllRegExe] dxdllreg.exe
O4 - HKLM\..\Run: [Conceptronic Conceptronic 54Mbps Wireless Utility] C:\Programas\Conceptronic\Conceptronic 54Mbps Wireless Utility\WLANmon.exe
O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Programas\ANI\ANIWZCS2 Service\WZCSLDR2.exe
O4 - HKLM\..\Run: [AVWLPSTA.exe] AVWLPSTA.EXE START
O4 - HKLM\..\Run: [TkBellExe] "C:\Programas\Ficheiros comuns\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Programas\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [ccApp] "C:\Programas\Ficheiros comuns\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [GhostStartTrayApp] C:\Programas\Norton SystemWorks\Norton Ghost\GhostStartTrayApp.exe
O4 - HKLM\..\Run: [AcctMgr] C:\Programas\Norton SystemWorks\Password Manager\AcctMgr.exe /startup
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programas\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programas\MSN Messenger\MsnMsgr.Exe" /background
O4 - Startup: Netcount.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Programas\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programas\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programas\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Programas\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.co...ad/MsnPUpld.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Alpha Networks Inc. - C:\Programas\ANI\ANIWZCS2 Service\ANIWZCSdS.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programas\Ficheiros comuns\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Programas\Ficheiros comuns\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programas\Ficheiros comuns\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Programas\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Programas\ewido anti-malware\ewidoguard.exe
O23 - Service: GhostStartService - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~4\GHOSTS~2.EXE
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Programas\Norton SystemWorks\Norton Antivirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: SAVScan - Symantec Corporation - C:\Programas\Norton SystemWorks\Norton Antivirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHEI~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Programas\Ficheiros comuns\Symantec Shared\SNDSrvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Programas\Ficheiros comuns\Symantec Shared\CCPD-LC\symlcsvc.exe

***********************************

ewido log (it is in portuguese, limpo com backup=clean with backup):

---------------------------------------------------------
ewido anti-malware - Relatório de verificação
---------------------------------------------------------

+ Criado em: 19:32:21, 07-01-2006
+ Relatório-Checksum: D64E720C

+ Resultado da verificação:

HKLM\SOFTWARE\Classes\CLSID\{4C96C433-2EDC-3926-B873-410DB1199685} -> Spyware.CoolWebSearch : Limpo com backup
:mozilla.16:C:\Documents and Settings\Luis Silva\Application Data\Mozilla\Firefox\Profiles\g185u0eq.default\cookies.txt -> Spyware.Cookie.Tribalfusion : Limpo com backup
:mozilla.18:C:\Documents and Settings\Luis Silva\Application Data\Mozilla\Firefox\Profiles\g185u0eq.default\cookies.txt -> Spyware.Cookie.Weborama : Limpo com backup
:mozilla.24:C:\Documents and Settings\Luis Silva\Application Data\Mozilla\Firefox\Profiles\g185u0eq.default\cookies.txt -> Spyware.Cookie.Statcounter : Limpo com backup
:mozilla.25:C:\Documents and Settings\Luis Silva\Application Data\Mozilla\Firefox\Profiles\g185u0eq.default\cookies.txt -> Spyware.Cookie.Casalemedia : Limpo com backup
:mozilla.26:C:\Documents and Settings\Luis Silva\Application Data\Mozilla\Firefox\Profiles\g185u0eq.default\cookies.txt -> Spyware.Cookie.Casalemedia : Limpo com backup
:mozilla.27:C:\Documents and Settings\Luis Silva\Application Data\Mozilla\Firefox\Profiles\g185u0eq.default\cookies.txt -> Spyware.Cookie.Casalemedia : Limpo com backup
:mozilla.44:C:\Documents and Settings\Luis Silva\Application Data\Mozilla\Firefox\Profiles\g185u0eq.default\cookies.txt -> Spyware.Cookie.Adserver : Limpo com backup
:mozilla.45:C:\Documents and Settings\Luis Silva\Application Data\Mozilla\Firefox\Profiles\g185u0eq.default\cookies.txt -> Spyware.Cookie.Adserver : Limpo com backup
:mozilla.46:C:\Documents and Settings\Luis Silva\Application Data\Mozilla\Firefox\Profiles\g185u0eq.default\cookies.txt -> Spyware.Cookie.Adserver : Limpo com backup
:mozilla.49:C:\Documents and Settings\Luis Silva\Application Data\Mozilla\Firefox\Profiles\g185u0eq.default\cookies.txt -> Spyware.Cookie.Adtech : Limpo com backup
:mozilla.50:C:\Documents and Settings\Luis Silva\Application Data\Mozilla\Firefox\Profiles\g185u0eq.default\cookies.txt -> Spyware.Cookie.Adtech : Limpo com backup
:mozilla.52:C:\Documents and Settings\Luis Silva\Application Data\Mozilla\Firefox\Profiles\g185u0eq.default\cookies.txt -> Spyware.Cookie.Falkag : Limpo com backup
:mozilla.76:C:\Documents and Settings\Luis Silva\Application Data\Mozilla\Firefox\Profiles\g185u0eq.default\cookies.txt -> Spyware.Cookie.Overture : Limpo com backup
:mozilla.77:C:\Documents and Settings\Luis Silva\Application Data\Mozilla\Firefox\Profiles\g185u0eq.default\cookies.txt -> Spyware.Cookie.Overture : Limpo com backup
:mozilla.88:C:\Documents and Settings\Luis Silva\Application Data\Mozilla\Firefox\Profiles\g185u0eq.default\cookies.txt -> Spyware.Cookie.Falkag : Limpo com backup
:mozilla.89:C:\Documents and Settings\Luis Silva\Application Data\Mozilla\Firefox\Profiles\g185u0eq.default\cookies.txt -> Spyware.Cookie.Falkag : Limpo com backup
:mozilla.93:C:\Documents and Settings\Luis Silva\Application Data\Mozilla\Firefox\Profiles\g185u0eq.default\cookies.txt -> Spyware.Cookie.Googleadservices : Limpo com backup
:mozilla.94:C:\Documents and Settings\Luis Silva\Application Data\Mozilla\Firefox\Profiles\g185u0eq.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Limpo com backup
:mozilla.95:C:\Documents and Settings\Luis Silva\Application Data\Mozilla\Firefox\Profiles\g185u0eq.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Limpo com backup
:mozilla.96:C:\Documents and Settings\Luis Silva\Application Data\Mozilla\Firefox\Profiles\g185u0eq.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Limpo com backup
:mozilla.97:C:\Documents and Settings\Luis Silva\Application Data\Mozilla\Firefox\Profiles\g185u0eq.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Limpo com backup
:mozilla.98:C:\Documents and Settings\Luis Silva\Application Data\Mozilla\Firefox\Profiles\g185u0eq.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Limpo com backup
:mozilla.99:C:\Documents and Settings\Luis Silva\Application Data\Mozilla\Firefox\Profiles\g185u0eq.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Limpo com backup
:mozilla.100:C:\Documents and Settings\Luis Silva\Application Data\Mozilla\Firefox\Profiles\g185u0eq.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Limpo com backup
:mozilla.101:C:\Documents and Settings\Luis Silva\Application Data\Mozilla\Firefox\Profiles\g185u0eq.default\cookies.txt -> Spyware.Cookie.Googleadservices : Limpo com backup
C:\Documents and Settings\Luis Silva\Cookies\luis silva@ad.yieldmanager[2].txt -> Spyware.Cookie.Yieldmanager : Limpo com backup
C:\Documents and Settings\Luis Silva\Cookies\luis silva@adtech[2].txt -> Spyware.Cookie.Adtech : Limpo com backup
C:\Documents and Settings\Luis Silva\Cookies\luis silva@as-eu.falkag[1].txt -> Spyware.Cookie.Falkag : Limpo com backup
C:\Documents and Settings\Luis Silva\Cookies\luis silva@casalemedia[2].txt -> Spyware.Cookie.Casalemedia : Limpo com backup
C:\Documents and Settings\Luis Silva\Cookies\luis silva@overture[1].txt -> Spyware.Cookie.Overture : Limpo com backup
C:\Documents and Settings\Luis Silva\Cookies\luis silva@sel.as-eu.falkag[1].txt -> Spyware.Cookie.Falkag : Limpo com backup
C:\Documents and Settings\Luis Silva\Cookies\luis silva@statcounter[1].txt -> Spyware.Cookie.Statcounter : Limpo com backup
C:\Documents and Settings\Luis Silva\Cookies\luis silva@tribalfusion[1].txt -> Spyware.Cookie.Tribalfusion : Limpo com backup
C:\Documents and Settings\Luis Silva\Cookies\luis silva@weborama[1].txt -> Spyware.Cookie.Weborama : Limpo com backup
C:\Documents and Settings\Luis Silva\Cookies\luis silva@z1.adserver[1].txt -> Spyware.Cookie.Adserver : Limpo com backup
C:\Documents and Settings\Luis Silva\Definições locais\Application Data\Sunbelt Software\CounterSpy\Quarantine\B83E296B-5F68-4C25-A011-F90BB0\6778069D-199A-468F-9F63-7EBD3B -> Not-A-Virus.Hoax.Win32.Renos.al : Limpo com backup
C:\Documents and Settings\Luis Silva\Definições locais\Temporary Internet Files\Content.IE5\E7EBAH6B\ysb_prompt[1].htm -> Downloader.IstBar.j : Limpo com backup
C:\RECYCLER\NPROTECT\00003016.dll -> Downloader.Agent.bc : Limpo com backup
C:\RECYCLER\NPROTECT\00003019.exe -> Downloader.Agent.td : Limpo com backup
:mozilla.7:C:\RECYCLER\NPROTECT\00003400.MOZ -> Spyware.Cookie.Weborama : Limpo com backup
:mozilla.13:C:\RECYCLER\NPROTECT\00003400.MOZ -> Spyware.Cookie.Statcounter : Limpo com backup
:mozilla.14:C:\RECYCLER\NPROTECT\00003400.MOZ -> Spyware.Cookie.Casalemedia : Limpo com backup
:mozilla.15:C:\RECYCLER\NPROTECT\00003400.MOZ -> Spyware.Cookie.Casalemedia : Limpo com backup
:mozilla.16:C:\RECYCLER\NPROTECT\00003400.MOZ -> Spyware.Cookie.Casalemedia : Limpo com backup
:mozilla.34:C:\RECYCLER\NPROTECT\00003400.MOZ -> Spyware.Cookie.Adserver : Limpo com backup
:mozilla.35:C:\RECYCLER\NPROTECT\00003400.MOZ -> Spyware.Cookie.Adserver : Limpo com backup
:mozilla.36:C:\RECYCLER\NPROTECT\00003400.MOZ -> Spyware.Cookie.Adserver : Limpo com backup
:mozilla.40:C:\RECYCLER\NPROTECT\00003400.MOZ -> Spyware.Cookie.Adtech : Limpo com backup
:mozilla.41:C:\RECYCLER\NPROTECT\00003400.MOZ -> Spyware.Cookie.Adtech : Limpo com backup
:mozilla.43:C:\RECYCLER\NPROTECT\00003400.MOZ -> Spyware.Cookie.Falkag : Limpo com backup
:mozilla.59:C:\RECYCLER\NPROTECT\00003400.MOZ -> Spyware.Cookie.Tribalfusion : Limpo com backup
:mozilla.69:C:\RECYCLER\NPROTECT\00003400.MOZ -> Spyware.Cookie.Overture : Limpo com backup
:mozilla.70:C:\RECYCLER\NPROTECT\00003400.MOZ -> Spyware.Cookie.Overture : Limpo com backup
:mozilla.71:C:\RECYCLER\NPROTECT\00003400.MOZ -> Spyware.Cookie.Overture : Limpo com backup
:mozilla.85:C:\RECYCLER\NPROTECT\00003400.MOZ -> Spyware.Cookie.Falkag : Limpo com backup
:mozilla.86:C:\RECYCLER\NPROTECT\00003400.MOZ -> Spyware.Cookie.Falkag : Limpo com backup
:mozilla.90:C:\RECYCLER\NPROTECT\00003400.MOZ -> Spyware.Cookie.Googleadservices : Limpo com backup
:mozilla.91:C:\RECYCLER\NPROTECT\00003400.MOZ -> Spyware.Cookie.Yieldmanager : Limpo com backup
:mozilla.92:C:\RECYCLER\NPROTECT\00003400.MOZ -> Spyware.Cookie.Yieldmanager : Limpo com backup
:mozilla.93:C:\RECYCLER\NPROTECT\00003400.MOZ -> Spyware.Cookie.Yieldmanager : Limpo com backup
:mozilla.94:C:\RECYCLER\NPROTECT\00003400.MOZ -> Spyware.Cookie.Yieldmanager : Limpo com backup
:mozilla.95:C:\RECYCLER\NPROTECT\00003400.MOZ -> Spyware.Cookie.Yieldmanager : Limpo com backup
:mozilla.96:C:\RECYCLER\NPROTECT\00003400.MOZ -> Spyware.Cookie.Yieldmanager : Limpo com backup
:mozilla.97:C:\RECYCLER\NPROTECT\00003400.MOZ -> Spyware.Cookie.Yieldmanager : Limpo com backup
:mozilla.98:C:\RECYCLER\NPROTECT\00003400.MOZ -> Spyware.Cookie.Googleadservices : Limpo com backup
:mozilla.13:C:\RECYCLER\NPROTECT\00003401.MOZ -> Spyware.Cookie.Weborama : Limpo com backup
:mozilla.19:C:\RECYCLER\NPROTECT\00003401.MOZ -> Spyware.Cookie.Statcounter : Limpo com backup
:mozilla.20:C:\RECYCLER\NPROTECT\00003401.MOZ -> Spyware.Cookie.Casalemedia : Limpo com backup
:mozilla.21:C:\RECYCLER\NPROTECT\00003401.MOZ -> Spyware.Cookie.Casalemedia : Limpo com backup
:mozilla.22:C:\RECYCLER\NPROTECT\00003401.MOZ -> Spyware.Cookie.Casalemedia : Limpo com backup
:mozilla.39:C:\RECYCLER\NPROTECT\00003401.MOZ -> Spyware.Cookie.Adserver : Limpo com backup
:mozilla.40:C:\RECYCLER\NPROTECT\00003401.MOZ -> Spyware.Cookie.Adserver : Limpo com backup
:mozilla.41:C:\RECYCLER\NPROTECT\00003401.MOZ -> Spyware.Cookie.Adserver : Limpo com backup
:mozilla.44:C:\RECYCLER\NPROTECT\00003401.MOZ -> Spyware.Cookie.Adtech : Limpo com backup
:mozilla.45:C:\RECYCLER\NPROTECT\00003401.MOZ -> Spyware.Cookie.Adtech : Limpo com backup
:mozilla.47:C:\RECYCLER\NPROTECT\00003401.MOZ -> Spyware.Cookie.Falkag : Limpo com backup
:mozilla.62:C:\RECYCLER\NPROTECT\00003401.MOZ -> Spyware.Cookie.Tribalfusion : Limpo com backup
:mozilla.72:C:\RECYCLER\NPROTECT\00003401.MOZ -> Spyware.Cookie.Overture : Limpo com backup
:mozilla.73:C:\RECYCLER\NPROTECT\00003401.MOZ -> Spyware.Cookie.Overture : Limpo com backup
:mozilla.84:C:\RECYCLER\NPROTECT\00003401.MOZ -> Spyware.Cookie.Falkag : Limpo com backup
:mozilla.85:C:\RECYCLER\NPROTECT\00003401.MOZ -> Spyware.Cookie.Falkag : Limpo com backup
:mozilla.89:C:\RECYCLER\NPROTECT\00003401.MOZ -> Spyware.Cookie.Googleadservices : Limpo com backup
:mozilla.90:C:\RECYCLER\NPROTECT\00003401.MOZ -> Spyware.Cookie.Yieldmanager : Limpo com backup
:mozilla.91:C:\RECYCLER\NPROTECT\00003401.MOZ -> Spyware.Cookie.Yieldmanager : Limpo com backup
:mozilla.92:C:\RECYCLER\NPROTECT\00003401.MOZ -> Spyware.Cookie.Yieldmanager : Limpo com backup
:mozilla.93:C:\RECYCLER\NPROTECT\00003401.MOZ -> Spyware.Cookie.Yieldmanager : Limpo com backup
:mozilla.94:C:\RECYCLER\NPROTECT\00003401.MOZ -> Spyware.Cookie.Yieldmanager : Limpo com backup
:mozilla.95:C:\RECYCLER\NPROTECT\00003401.MOZ -> Spyware.Cookie.Yieldmanager : Limpo com backup
:mozilla.96:C:\RECYCLER\NPROTECT\00003401.MOZ -> Spyware.Cookie.Yieldmanager : Limpo com backup
:mozilla.97:C:\RECYCLER\NPROTECT\00003401.MOZ -> Spyware.Cookie.Googleadservices : Limpo com backup
:mozilla.9:C:\RECYCLER\NPROTECT\00003402.MOZ -> Spyware.Cookie.Tribalfusion : Limpo com backup
:mozilla.17:C:\RECYCLER\NPROTECT\00003402.MOZ -> Spyware.Cookie.Weborama : Limpo com backup
:mozilla.23:C:\RECYCLER\NPROTECT\00003402.MOZ -> Spyware.Cookie.Statcounter : Limpo com backup
:mozilla.24:C:\RECYCLER\NPROTECT\00003402.MOZ -> Spyware.Cookie.Casalemedia : Limpo com backup
:mozilla.25:C:\RECYCLER\NPROTECT\00003402.MOZ -> Spyware.Cookie.Casalemedia : Limpo com backup
:mozilla.26:C:\RECYCLER\NPROTECT\00003402.MOZ -> Spyware.Cookie.Casalemedia : Limpo com backup
:mozilla.43:C:\RECYCLER\NPROTECT\00003402.MOZ -> Spyware.Cookie.Adserver : Limpo com backup
:mozilla.44:C:\RECYCLER\NPROTECT\00003402.MOZ -> Spyware.Cookie.Adserver : Limpo com backup
:mozilla.45:C:\RECYCLER\NPROTECT\00003402.MOZ -> Spyware.Cookie.Adserver : Limpo com backup
:mozilla.48:C:\RECYCLER\NPROTECT\00003402.MOZ -> Spyware.Cookie.Adtech : Limpo com backup
:mozilla.49:C:\RECYCLER\NPROTECT\00003402.MOZ -> Spyware.Cookie.Adtech : Limpo com backup
:mozilla.51:C:\RECYCLER\NPROTECT\00003402.MOZ -> Spyware.Cookie.Falkag : Limpo com backup
:mozilla.75:C:\RECYCLER\NPROTECT\00003402.MOZ -> Spyware.Cookie.Overture : Limpo com backup
:mozilla.76:C:\RECYCLER\NPROTECT\00003402.MOZ -> Spyware.Cookie.Overture : Limpo com backup
:mozilla.87:C:\RECYCLER\NPROTECT\00003402.MOZ -> Spyware.Cookie.Falkag : Limpo com backup
:mozilla.88:C:\RECYCLER\NPROTECT\00003402.MOZ -> Spyware.Cookie.Falkag : Limpo com backup
:mozilla.92:C:\RECYCLER\NPROTECT\00003402.MOZ -> Spyware.Cookie.Googleadservices : Limpo com backup
:mozilla.93:C:\RECYCLER\NPROTECT\00003402.MOZ -> Spyware.Cookie.Yieldmanager : Limpo com backup
:mozilla.94:C:\RECYCLER\NPROTECT\00003402.MOZ -> Spyware.Cookie.Yieldmanager : Limpo com backup
:mozilla.95:C:\RECYCLER\NPROTECT\00003402.MOZ -> Spyware.Cookie.Yieldmanager : Limpo com backup
:mozilla.96:C:\RECYCLER\NPROTECT\00003402.MOZ -> Spyware.Cookie.Yieldmanager : Limpo com backup
:mozilla.97:C:\RECYCLER\NPROTECT\00003402.MOZ -> Spyware.Cookie.Yieldmanager : Limpo com backup
:mozilla.98:C:\RECYCLER\NPROTECT\00003402.MOZ -> Spyware.Cookie.Yieldmanager : Limpo com backup
:mozilla.99:C:\RECYCLER\NPROTECT\00003402.MOZ -> Spyware.Cookie.Yieldmanager : Limpo com backup
:mozilla.100:C:\RECYCLER\NPROTECT\00003402.MOZ -> Spyware.Cookie.Googleadservices : Limpo com backup
:mozilla.9:C:\RECYCLER\NPROTECT\00003418.MOZ -> Spyware.Cookie.Tribalfusion : Limpo com backup
:mozilla.17:C:\RECYCLER\NPROTECT\00003418.MOZ -> Spyware.Cookie.Weborama : Limpo com backup
:mozilla.23:C:\RECYCLER\NPROTECT\00003418.MOZ -> Spyware.Cookie.Statcounter : Limpo com backup
:mozilla.24:C:\RECYCLER\NPROTECT\00003418.MOZ -> Spyware.Cookie.Casalemedia : Limpo com backup
:mozilla.25:C:\RECYCLER\NPROTECT\00003418.MOZ -> Spyware.Cookie.Casalemedia : Limpo com backup
:mozilla.26:C:\RECYCLER\NPROTECT\00003418.MOZ -> Spyware.Cookie.Casalemedia : Limpo com backup
:mozilla.43:C:\RECYCLER\NPROTECT\00003418.MOZ -> Spyware.Cookie.Adserver : Limpo com backup
:mozilla.44:C:\RECYCLER\NPROTECT\00003418.MOZ -> Spyware.Cookie.Adserver : Limpo com backup
:mozilla.45:C:\RECYCLER\NPROTECT\00003418.MOZ -> Spyware.Cookie.Adserver : Limpo com backup
:mozilla.48:C:\RECYCLER\NPROTECT\00003418.MOZ -> Spyware.Cookie.Adtech : Limpo com backup
:mozilla.49:C:\RECYCLER\NPROTECT\00003418.MOZ -> Spyware.Cookie.Adtech : Limpo com backup
:mozilla.51:C:\RECYCLER\NPROTECT\00003418.MOZ -> Spyware.Cookie.Falkag : Limpo com backup
:mozilla.75:C:\RECYCLER\NPROTECT\00003418.MOZ -> Spyware.Cookie.Overture : Limpo com backup
:mozilla.76:C:\RECYCLER\NPROTECT\00003418.MOZ -> Spyware.Cookie.Overture : Limpo com backup
:mozilla.87:C:\RECYCLER\NPROTECT\00003418.MOZ -> Spyware.Cookie.Falkag : Limpo com backup
:mozilla.88:C:\RECYCLER\NPROTECT\00003418.MOZ -> Spyware.Cookie.Falkag : Limpo com backup
:mozilla.92:C:\RECYCLER\NPROTECT\00003418.MOZ -> Spyware.Cookie.Googleadservices : Limpo com backup
:mozilla.93:C:\RECYCLER\NPROTECT\00003418.MOZ -> Spyware.Cookie.Yieldmanager : Limpo com backup
:mozilla.94:C:\RECYCLER\NPROTECT\00003418.MOZ -> Spyware.Cookie.Yieldmanager : Limpo com backup
:mozilla.95:C:\RECYCLER\NPROTECT\00003418.MOZ -> Spyware.Cookie.Yieldmanager : Limpo com backup
:mozilla.96:C:\RECYCLER\NPROTECT\00003418.MOZ -> Spyware.Cookie.Yieldmanager : Limpo com backup
:mozilla.97:C:\RECYCLER\NPROTECT\00003418.MOZ -> Spyware.Cookie.Yieldmanager : Limpo com backup
:mozilla.98:C:\RECYCLER\NPROTECT\00003418.MOZ -> Spyware.Cookie.Yieldmanager : Limpo com backup
:mozilla.99:C:\RECYCLER\NPROTECT\00003418.MOZ -> Spyware.Cookie.Yieldmanager : Limpo com backup
:mozilla.100:C:\RECYCLER\NPROTECT\00003418.MOZ -> Spyware.Cookie.Googleadservices : Limpo com backup
:mozilla.10:C:\RECYCLER\NPROTECT\00003499.MOZ -> Spyware.Cookie.Tribalfusion : Limpo com backup
:mozilla.18:C:\RECYCLER\NPROTECT\00003499.MOZ -> Spyware.Cookie.Weborama : Limpo com backup
:mozilla.24:C:\RECYCLER\NPROTECT\00003499.MOZ -> Spyware.Cookie.Statcounter : Limpo com backup
:mozilla.25:C:\RECYCLER\NPROTECT\00003499.MOZ -> Spyware.Cookie.Casalemedia : Limpo com backup
:mozilla.26:C:\RECYCLER\NPROTECT\00003499.MOZ -> Spyware.Cookie.Casalemedia : Limpo com backup
:mozilla.27:C:\RECYCLER\NPROTECT\00003499.MOZ -> Spyware.Cookie.Casalemedia : Limpo com backup
:mozilla.44:C:\RECYCLER\NPROTECT\00003499.MOZ -> Spyware.Cookie.Adserver : Limpo com backup
:mozilla.45:C:\RECYCLER\NPROTECT\00003499.MOZ -> Spyware.Cookie.Adserver : Limpo com backup
:mozilla.46:C:\RECYCLER\NPROTECT\00003499.MOZ -> Spyware.Cookie.Adserver : Limpo com backup
:mozilla.49:C:\RECYCLER\NPROTECT\00003499.MOZ -> Spyware.Cookie.Adtech : Limpo com backup
:mozilla.50:C:\RECYCLER\NPROTECT\00003499.MOZ -> Spyware.Cookie.Adtech : Limpo com backup
:mozilla.52:C:\RECYCLER\NPROTECT\00003499.MOZ -> Spyware.Cookie.Falkag : Limpo com backup
:mozilla.76:C:\RECYCLER\NPROTECT\00003499.MOZ -> Spyware.Cookie.Overture : Limpo com backup
:mozilla.77:C:\RECYCLER\NPROTECT\00003499.MOZ -> Spyware.Cookie.Overture : Limpo com backup
:mozilla.88:C:\RECYCLER\NPROTECT\00003499.MOZ -> Spyware.Cookie.Falkag : Limpo com backup
:mozilla.89:C:\RECYCLER\NPROTECT\00003499.MOZ -> Spyware.Cookie.Falkag : Limpo com backup
:mozilla.93:C:\RECYCLER\NPROTECT\00003499.MOZ -> Spyware.Cookie.Googleadservices : Limpo com backup
:mozilla.94:C:\RECYCLER\NPROTECT\00003499.MOZ -> Spyware.Cookie.Yieldmanager : Limpo com backup
:mozilla.95:C:\RECYCLER\NPROTECT\00003499.MOZ -> Spyware.Cookie.Yieldmanager : Limpo com backup
:mozilla.96:C:\RECYCLER\NPROTECT\00003499.MOZ -> Spyware.Cookie.Yieldmanager : Limpo com backup
:mozilla.97:C:\RECYCLER\NPROTECT\00003499.MOZ -> Spyware.Cookie.Yieldmanager : Limpo com backup
:mozilla.98:C:\RECYCLER\NPROTECT\00003499.MOZ -> Spyware.Cookie.Yieldmanager : Limpo com backup
:mozilla.99:C:\RECYCLER\NPROTECT\00003499.MOZ -> Spyware.Cookie.Yieldmanager : Limpo com backup
:mozilla.100:C:\RECYCLER\NPROTECT\00003499.MOZ -> Spyware.Cookie.Yieldmanager : Limpo com backup
:mozilla.101:C:\RECYCLER\NPROTECT\00003499.MOZ -> Spyware.Cookie.Googleadservices : Limpo com backup
C:\RECYCLER\S-1-5-21-854245398-746137067-1202660629-1003\Dc14.exe -> Downloader.Agent.td : Limpo com backup


::Fim do Relatório


********************************+

AB log:

AboutBuster 6.0
Scan started on [07-01-2006] at [18:35:43]
-------------------------------------------------------------
Internet Explorer Instances Terminated!
HomeSearch Service stopped if present
-------------------------------------------------------------
No Ads Found!
-------------------------------------------------------------
No Files Found!
-------------------------------------------------------------
Scan was COMPLETED SUCCESSFULLY at 18:37:56


*********************************

Once again, thanks for helping. i really appreciate it!

[LDTate]

Good job. Only one left over, but we're not finished yet


I suggest you do this:

Run hijackthis. Hit None of the above, Click Do a System Scan Only. Put a Check in the box on the left side on these:

R3 - Default URLSearchHook is missing

Close ALL windows and browsers except HijackThis and click "Fix checked"


1. Open My Computer
2. Right click on your hard drive that you wish to clean (C drive, for example)
3. In the context menu that opens, select properties
4. Under the general tab you should select Disk Cleanup
5. Windows will scan your drive which will take a few seconds/minutes
6. A box will display the various files you can remove.
Check all boxes except compress old files (If listed)
7. Click OK and windows will comply.

Restart your computer.

Reboot and "copy/paste" a new log file into this thread.
Also please describe how your computer behaves at the moment.

[goldeneye]

Here's thr new log:

Logfile of HijackThis v1.99.1
Scan saved at 19:55:42, on 09-01-2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programas\Ficheiros comuns\Symantec Shared\ccSetMgr.exe
C:\Programas\Ficheiros comuns\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Programas\CyberLink\PowerDVD\PDVDServ.exe
C:\Programas\HP\HP Software Update\HPWuSchd.exe
C:\Programas\HP\hpcoretech\hpcmpmgr.exe
C:\Programas\Conceptronic\Conceptronic 54Mbps Wireless Utility\WLANmon.exe
C:\Programas\ewido anti-malware\ewidoctrl.exe
C:\Programas\ANI\ANIWZCS2 Service\WZCSLDR2.exe
C:\WINDOWS\system32\AVWLPSTA.EXE
C:\Programas\ewido anti-malware\ewidoguard.exe
C:\Programas\Ficheiros comuns\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\devldr32.exe
C:\Programas\D-Tools\daemon.exe
C:\Programas\Ficheiros comuns\Symantec Shared\ccApp.exe
C:\Programas\Norton SystemWorks\Norton Ghost\GhostStartTrayApp.exe
C:\Programas\Norton SystemWorks\Password Manager\AcctMgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programas\Messenger\msmsgs.exe
C:\Programas\MSN Messenger\MsnMsgr.Exe
C:\PROGRA~1\NORTON~1\NORTON~4\GHOSTS~2.EXE
C:\Programas\HP\Digital Imaging\bin\hpqtra08.exe
C:\Programas\Ficheiros comuns\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Programas\Netcount\Netcount.exe
C:\Programas\Norton SystemWorks\Norton Antivirus\navapsvc.exe
C:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE
C:\Programas\Norton SystemWorks\Norton Antivirus\SAVScan.exe
C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\system32\svchost.exe
C:\Programas\Ficheiros comuns\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Programas\Ficheiros comuns\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programas\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Luis Silva\Ambiente de trabalho\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hiperligações
F2 - REG:system.ini: UserInit=C:\WINDOWS\regedit /s C:\pav.reg,C:\WINDOWS\system32\pavdr.exe,C:\WINDOWS\system32\userinit.exe,
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programas\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] C:\Programas\CyberLink\PowerDVD\PDVDServ.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Programas\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Programas\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [DXDllRegExe] dxdllreg.exe
O4 - HKLM\..\Run: [Conceptronic Conceptronic 54Mbps Wireless Utility] C:\Programas\Conceptronic\Conceptronic 54Mbps Wireless Utility\WLANmon.exe
O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Programas\ANI\ANIWZCS2 Service\WZCSLDR2.exe
O4 - HKLM\..\Run: [AVWLPSTA.exe] AVWLPSTA.EXE START
O4 - HKLM\..\Run: [TkBellExe] "C:\Programas\Ficheiros comuns\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Programas\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [ccApp] "C:\Programas\Ficheiros comuns\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [GhostStartTrayApp] C:\Programas\Norton SystemWorks\Norton Ghost\GhostStartTrayApp.exe
O4 - HKLM\..\Run: [AcctMgr] C:\Programas\Norton SystemWorks\Password Manager\AcctMgr.exe /startup
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programas\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programas\MSN Messenger\MsnMsgr.Exe" /background
O4 - Startup: Netcount.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Programas\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programas\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programas\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Programas\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.co...ad/MsnPUpld.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Alpha Networks Inc. - C:\Programas\ANI\ANIWZCS2 Service\ANIWZCSdS.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programas\Ficheiros comuns\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Programas\Ficheiros comuns\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programas\Ficheiros comuns\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Programas\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Programas\ewido anti-malware\ewidoguard.exe
O23 - Service: GhostStartService - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~4\GHOSTS~2.EXE
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Programas\Norton SystemWorks\Norton Antivirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: SAVScan - Symantec Corporation - C:\Programas\Norton SystemWorks\Norton Antivirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHEI~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Programas\Ficheiros comuns\Symantec Shared\SNDSrvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Programas\Ficheiros comuns\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Programas\Ficheiros comuns\Symantec Shared\Security Center\SymWSC.exe


The computor is a bit slower than it used to be before... I don't know if it has to do with this or not.
Anyway, those anoying bars and messages seeling the anti-spyware are gone. It seems clean now
Thanks

[LDTate]

lets see if this will help speed it up.

Backup your Registry...
- Press "CTRL - ALT - DEL" keys all at the same time to start "Task Manager"
- In the Task Manager window click on "File", then from the drop-down menu select "New Task (Run...)"
- In the "Create New Task" window enter\type "regedit" (without quotes)
- Once Regedit opens click on the FILE menu and select Export
- Save the file as backup. Save the file somewhere you will remember and not delete.
IMPORTANT: make sure to set the export range to ALL



I recommend you download RegSeeker. Extract it to it's own folder, open and double click RegSeeker.exe to start the program. Maximize the window and click clean registry. Check all sections and click OK. When the scan is complete, verify the backup box in lower left corner is checked and click the select all button, then select all again. Then right click within the search results and select delete. Run it again and again, deleting everything it finds until it finds nothing. Reboot and make sure your programs are working properly, control panel and add/remove programs windows open, etc (basically just do a quick check of everything). In the event anything was 'broken', you can open RegSeeker, click backups and double click any/all files to put the information back. A reboot may be required for the effects to be seen. Reboot When done.

[LDTate]

Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoy...showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php