12 replies to this topic

[birdsnare]

I have oinadserver on my computer and can't figure out how to remove it. Below is my hijackthis log. Thanks in advance for help.

Logfile of HijackThis v1.99.1
Scan saved at 5:07:08 PM, on 2/26/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\HPQ\One-Touch\OneTouch.EXE
C:\WINDOWS\system32\carpserv.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.5.0_01\bin\jucheck.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\NetZero\exec.exe
C:\WINDOWS\system32\d?xplore.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\ICROSO~1.NET\lsass.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\OpenOffice.org 2.0\program\soffice.exe
C:\Program Files\OpenOffice.org 2.0\program\soffice.BIN
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\HPConfig.exe
C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe
C:\M3 Server\zservice.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Veoh\VeohClientService.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\NetZero\exec.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\JASON FOWLER\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://qus8l.hpwis.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://my.netzero.ne...ch?r=minisearch
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://my.netzero.ne...ch?r=minisearch
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://my.netzero.ne...ch?r=minisearch
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = localhost:8080
R3 - URLSearchHook: (no name) - {B5DA7B3C-9BA4-F454-A4AE-E0CB599E5CC8} - C:\WINDOWS\system32\azs.dll
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
N3 - Netscape 7: user_pref("browser.startup.homepage", "http://home.netscape.../7_2/home.html"); (C:\Documents and Settings\JASON FOWLER\Application Data\Mozilla\Profiles\default\vy7tkhou.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\JASON FOWLER\Application Data\Mozilla\Profiles\default\vy7tkhou.slt\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {125376B9-8437-D29D-56C3-E4D5BDA1B5AC} - C:\WINDOWS\system32\avhmqkb.dll (file missing)
O2 - BHO: (no name) - {12E116BC-A824-92DB-7FC7-8B2D61D4F9CF} - C:\WINDOWS\system32\hhuoov.dll (file missing)
O2 - BHO: (no name) - {17C596B7-3663-3399-0BA7-57AE79E8E0F3} - C:\WINDOWS\system32\xvegdaa.dll (file missing)
O2 - BHO: (no name) - {227E46BA-A975-96DE-7BF4-DDF8FC98989B} - C:\WINDOWS\system32\avhmqkb.dll (file missing)
O2 - BHO: (no name) - {22CC26BF-8566-D698-52F0-B20020EDD4F8} - C:\WINDOWS\system32\hhuoov.dll (file missing)
O2 - BHO: (no name) - {277E46B9-A904-E7A9-7BF3-D4F88D91989C} - C:\WINDOWS\system32\avhmqkb.dll (file missing)
O2 - BHO: (no name) - {27E8A6B4-1B21-77DA-2690-6E8338D1CDC4} - C:\WINDOWS\system32\xvegdaa.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {93BC1D5B-A1B6-BC4B-9809-DEC81E8D2EC0} - C:\WINDOWS\system32\hvg.dll (file missing)
O2 - BHO: (no name) - {96BC1D58-A1C7-CD3C-980E-D7C86F842EC7} - C:\WINDOWS\system32\hvg.dll (file missing)
O2 - BHO: (no name) - {9D677D1A-9CD3-FB76-D65C-B23EB32B7A93} - C:\WINDOWS\system32\obmnwpo.dll (file missing)
O2 - BHO: (no name) - {A6912D5B-8C85-897F-B539-EEE52EBD03F0} - C:\WINDOWS\system32\hvg.dll (file missing)
O2 - BHO: (no name) - {B5DA7B3C-9BA4-F454-A4AE-E0CB599E5CC8} - C:\WINDOWS\system32\azs.dll
O2 - BHO: (no name) - {D6EE7720-CBE5-A81D-B889-E79B6FAF31C0} - C:\WINDOWS\system32\vsvm.dll (file missing)
O2 - BHO: (no name) - {D6EE7726-CBE5-A81D-B889-EA9B6AA531C7} - C:\WINDOWS\system32\vsvm.dll (file missing)
O2 - BHO: (no name) - {E6C34725-E6A7-EC5E-95BE-D3B62B9C1CF0} - C:\WINDOWS\system32\vsvm.dll (file missing)
O2 - BHO: (no name) - {EB0B71BA-CB2D-F1D6-7DE1-BC9E89380790} - C:\WINDOWS\system32\jgd.dll (file missing)
O2 - BHO: (no name) - {FB003310-88D6-E376-D5E9-AC0FD09D4FC0} - C:\WINDOWS\system32\gqerydq.dll (file missing)
O2 - BHO: (no name) - {FD0D6904-80C4-BE39-CF1D-F6BADB3E13C1} - C:\WINDOWS\system32\rrrex.dll (file missing)
O3 - Toolbar: ZeroBar - {F5735C15-1FB2-41FE-BA12-242757E69DDE} - C:\Program Files\NetZero\toolbar.dll
O3 - Toolbar: ZeroBar - {F0F8ECBE-D460-4B34-B007-56A92E8F84A7} - C:\Program Files\NetZero\Toolbar.dll
O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
O4 - HKLM\..\Run: [QT4HPOT] C:\Program Files\HPQ\One-Touch\OneTouch.EXE
O4 - HKLM\..\Run: [PreloadApp] c:\hp\drivers\printers\photosmart\hphprld.exe c:\hp\drivers\printers\photosmart\setup.exe -d
O4 - HKLM\..\Run: [DXM6Patch_981116] C:\WINDOWS\p_981116.exe /Q:A
O4 - HKLM\..\Run: [Display Settings] C:\Program Files\HPQ\Notebook Utilities\hptasks.exe /s
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [lmu] C:\WINDOWS\LMU.exe
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [hplampc] C:\WINDOWS\system32\hplampc.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKCU\..\Run: [NetZero_uoltray] C:\Program Files\NetZero\exec.exe regrun
O4 - HKCU\..\Run: [spc_w] "C:\Program Files\NZSearch\nzspc.exe" -w
O4 - HKCU\..\Run: [Qanwxfkv] C:\WINDOWS\system32\d?xplore.exe
O4 - HKCU\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Lerm] "C:\WINDOWS\ICROSO~1.NET\lsass.exe" -vt rbnd
O4 - Startup: OpenOffice.org 2.0.lnk = C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - c:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://qus8l.hpwis.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=48835
O16 - DPF: {31E68DE2-5548-4B23-88F0-C51E6A0F695E} (Microsoft PID Sniffer) - https://support.micr...ActiveX/odc.cab
O16 - DPF: {9A54032D-31F7-400D-B184-83B33BDE65FA} (MSN File Upload Control) - http://sc.groups.msn...eUC/MsnUpld.cab
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.c.../cpcScanner.cab
O16 - DPF: {F5C90925-ABBF-4475-88F5-8622B452BA9E} (Compaq System Data Class) - http://h30135.www3.h...er/SysQuery.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: HP Configuration Interface Service (HPConfig) - Hewlett-Packard - C:\WINDOWS\system32\HPConfig.exe
O23 - Service: HPWirelessMgr - Hewlett-Packard Co. - C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Mandarin M3 Server - Mandarin Library Automation, Inc. - C:\M3 Server\zservice.exe
O23 - Service: Veoh Client Service - Veoh Networks, Inc. - C:\Program Files\Veoh\VeohClientService.exe

[birdsnare]

I also ran it in safe mode. Here is the log:

Logfile of HijackThis v1.99.1
Scan saved at 8:04:56 AM, on 2/27/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\JASON FOWLER\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://qus8l.hpwis.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://my.netzero.ne...ch?r=minisearch
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://my.netzero.ne...ch?r=minisearch
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://my.netzero.ne...ch?r=minisearch
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = localhost:8080
R3 - URLSearchHook: (no name) - {B5DA7B3C-9BA4-F454-A4AE-E0CB599E5CC8} - C:\WINDOWS\system32\azs.dll
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
N3 - Netscape 7: user_pref("browser.startup.homepage", "http://home.netscape.../7_2/home.html"); (C:\Documents and Settings\JASON FOWLER\Application Data\Mozilla\Profiles\default\vy7tkhou.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\JASON FOWLER\Application Data\Mozilla\Profiles\default\vy7tkhou.slt\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {125376B9-8437-D29D-56C3-E4D5BDA1B5AC} - C:\WINDOWS\system32\avhmqkb.dll (file missing)
O2 - BHO: (no name) - {12E116BC-A824-92DB-7FC7-8B2D61D4F9CF} - C:\WINDOWS\system32\hhuoov.dll (file missing)
O2 - BHO: (no name) - {17C596B7-3663-3399-0BA7-57AE79E8E0F3} - C:\WINDOWS\system32\xvegdaa.dll (file missing)
O2 - BHO: (no name) - {227E46BA-A975-96DE-7BF4-DDF8FC98989B} - C:\WINDOWS\system32\avhmqkb.dll (file missing)
O2 - BHO: (no name) - {22CC26BF-8566-D698-52F0-B20020EDD4F8} - C:\WINDOWS\system32\hhuoov.dll (file missing)
O2 - BHO: (no name) - {277E46B9-A904-E7A9-7BF3-D4F88D91989C} - C:\WINDOWS\system32\avhmqkb.dll (file missing)
O2 - BHO: (no name) - {27E8A6B4-1B21-77DA-2690-6E8338D1CDC4} - C:\WINDOWS\system32\xvegdaa.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: (no name) - {93BC1D5B-A1B6-BC4B-9809-DEC81E8D2EC0} - C:\WINDOWS\system32\hvg.dll (file missing)
O2 - BHO: (no name) - {96BC1D58-A1C7-CD3C-980E-D7C86F842EC7} - C:\WINDOWS\system32\hvg.dll (file missing)
O2 - BHO: (no name) - {9D677D1A-9CD3-FB76-D65C-B23EB32B7A93} - C:\WINDOWS\system32\obmnwpo.dll (file missing)
O2 - BHO: (no name) - {A6912D5B-8C85-897F-B539-EEE52EBD03F0} - C:\WINDOWS\system32\hvg.dll (file missing)
O2 - BHO: (no name) - {B5DA7B3C-9BA4-F454-A4AE-E0CB599E5CC8} - C:\WINDOWS\system32\azs.dll
O2 - BHO: (no name) - {D6EE7720-CBE5-A81D-B889-E79B6FAF31C0} - C:\WINDOWS\system32\vsvm.dll (file missing)
O2 - BHO: (no name) - {D6EE7726-CBE5-A81D-B889-EA9B6AA531C7} - C:\WINDOWS\system32\vsvm.dll (file missing)
O2 - BHO: (no name) - {E6C34725-E6A7-EC5E-95BE-D3B62B9C1CF0} - C:\WINDOWS\system32\vsvm.dll (file missing)
O2 - BHO: (no name) - {EB0B71BA-CB2D-F1D6-7DE1-BC9E89380790} - C:\WINDOWS\system32\jgd.dll (file missing)
O2 - BHO: (no name) - {FB003310-88D6-E376-D5E9-AC0FD09D4FC0} - C:\WINDOWS\system32\gqerydq.dll (file missing)
O2 - BHO: (no name) - {FD0D6904-80C4-BE39-CF1D-F6BADB3E13C1} - C:\WINDOWS\system32\rrrex.dll (file missing)
O3 - Toolbar: ZeroBar - {F5735C15-1FB2-41FE-BA12-242757E69DDE} - C:\Program Files\NetZero\toolbar.dll
O3 - Toolbar: ZeroBar - {F0F8ECBE-D460-4B34-B007-56A92E8F84A7} - C:\Program Files\NetZero\Toolbar.dll
O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
O4 - HKLM\..\Run: [QT4HPOT] C:\Program Files\HPQ\One-Touch\OneTouch.EXE
O4 - HKLM\..\Run: [PreloadApp] c:\hp\drivers\printers\photosmart\hphprld.exe c:\hp\drivers\printers\photosmart\setup.exe -d
O4 - HKLM\..\Run: [DXM6Patch_981116] C:\WINDOWS\p_981116.exe /Q:A
O4 - HKLM\..\Run: [Display Settings] C:\Program Files\HPQ\Notebook Utilities\hptasks.exe /s
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [lmu] C:\WINDOWS\LMU.exe
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [hplampc] C:\WINDOWS\system32\hplampc.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKCU\..\Run: [NetZero_uoltray] C:\Program Files\NetZero\exec.exe regrun
O4 - HKCU\..\Run: [spc_w] "C:\Program Files\NZSearch\nzspc.exe" -w
O4 - HKCU\..\Run: [Qanwxfkv] C:\WINDOWS\system32\d?xplore.exe
O4 - HKCU\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Lerm] "C:\WINDOWS\ICROSO~1.NET\lsass.exe" -vt rbnd
O4 - Startup: OpenOffice.org 2.0.lnk = C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - c:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://qus8l.hpwis.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=48835
O16 - DPF: {31E68DE2-5548-4B23-88F0-C51E6A0F695E} (Microsoft PID Sniffer) - https://support.micr...ActiveX/odc.cab
O16 - DPF: {9A54032D-31F7-400D-B184-83B33BDE65FA} (MSN File Upload Control) - http://sc.groups.msn...eUC/MsnUpld.cab
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.c.../cpcScanner.cab
O16 - DPF: {F5C90925-ABBF-4475-88F5-8622B452BA9E} (Compaq System Data Class) - http://h30135.www3.h...er/SysQuery.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: HP Configuration Interface Service (HPConfig) - Hewlett-Packard - C:\WINDOWS\system32\HPConfig.exe
O23 - Service: HPWirelessMgr - Hewlett-Packard Co. - C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Mandarin M3 Server - Mandarin Library Automation, Inc. - C:\M3 Server\zservice.exe
O23 - Service: Veoh Client Service - Veoh Networks, Inc. - C:\Program Files\Veoh\VeohClientService.exe

[LDTate]

Hello birdsnare, Welcome to the forum.

This is what I suggest you do.


Please do not delete anything unless instructed to.

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Clear "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Clear "Hide protected operating system files."
Click Apply, and then click OK.


Even if you've already run these, make SURE they're up-to-date and run per instructions.

Make sure you have the up-to-date versions of Spybot V 1.4 and Ad-aware SE Build 1.06 . All are free and available below.

Download Spybot, install and update. Then download Ad-aware, install, and update.

Spybot:

Install the program and launch it.

Go to Start > Programs >Spybot > Search & Destroy and choose Spybot S&D

Close ALL windows except Spybot S&D
Click the button to "Search for Updates" and download and install the Updates.
Next click the button "Check for Problems"
When Spybot is complete, it will be showing "RED" (RED) entries "BLACK" entries and "GREEN" (GREEN) entries in the window
Put a check mark beside the RED (RED) entries ONLY.
Choose "Fix Selected Problems" and allow Spybot to fix the RED (RED) entries.

Ad-Aware FULL SCAN:

Install the program and launch it.

1. Launch Ad-Aware SE and run the WebUpdate feature. (Click on the Globe icon > Click connect > Click OK > Click Finish.)
2. Set up the Configurations as follows:
-- Click the Gear wheel at the top of the Ad-Aware window
-- Click General > Safety & Settings: Check (Green) all three.
-- Click Tweak > Cleaning Engine > UNcheck "Always try to unload modules before deletion".
3. Click "Proceed"
4. Click "Scan Now"
5. Deselect "Search for negligible risk entries" as negligible risk entries (MRU's) are not considered to be a threat.
6. Select "Search for low-risk threats"
7. Run the scanner using the Full Scan (Perform full system scan) mode.
8. When the scan has completed, select Next.
9. In the Scanning Results window, select the "Scan Summary" tab.
10. Check the box next to each "target family" you wish to remove.
11. Click next > Click OK.

Next:

Please download the trial version of ewido anti-malware 3.5 here:
http://www.ewido.net/en/download/
Install it, and update the definitions to the newest files. Do NOT run a scan yet.


Next, please reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Select the first option, to run Windows in Safe Mode.


Then please run Ewido, click on the Scanner run a full scan and let it clean everything it finds. Save the logfile from the scan.


Restart your computer in normal mode and please post a new HijackThis log, as well as the log from the Ewido scan.

Also please describe how your computer behaves at the moment.

[birdsnare]

LDTate,

Thanks for helping. Both before and after the scan, the computer acts the same. An annoying popup from oinadserver (outerinfo) pops up whenever I use IE. I try not to use IE much, but some sites really work better with it.

Also, it seems like it's running a little sluggish.

Here is the ewildo scan summary:
---------------------------------------------------------
ewido anti-malware - Scan report
---------------------------------------------------------

+ Created on: 7:03:53 AM, 3/2/2006
+ Report-Checksum: 1191AC25

+ Scan result:

HKLM\SOFTWARE\Classes\ImgConv.clsImgConv -> Adware.WebRebates : Cleaned with backup
HKLM\SOFTWARE\Classes\ImgConv.clsImgConv\Clsid -> Adware.WebRebates : Cleaned with backup
:mozilla.52:C:\Documents and Settings\JASON FOWLER\Application Data\Mozilla\Firefox\Profiles\skjrfnoq.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.53:C:\Documents and Settings\JASON FOWLER\Application Data\Mozilla\Firefox\Profiles\skjrfnoq.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.54:C:\Documents and Settings\JASON FOWLER\Application Data\Mozilla\Firefox\Profiles\skjrfnoq.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.55:C:\Documents and Settings\JASON FOWLER\Application Data\Mozilla\Firefox\Profiles\skjrfnoq.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.56:C:\Documents and Settings\JASON FOWLER\Application Data\Mozilla\Firefox\Profiles\skjrfnoq.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.57:C:\Documents and Settings\JASON FOWLER\Application Data\Mozilla\Firefox\Profiles\skjrfnoq.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.58:C:\Documents and Settings\JASON FOWLER\Application Data\Mozilla\Firefox\Profiles\skjrfnoq.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.65:C:\Documents and Settings\JASON FOWLER\Application Data\Mozilla\Firefox\Profiles\skjrfnoq.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned with backup
:mozilla.66:C:\Documents and Settings\JASON FOWLER\Application Data\Mozilla\Firefox\Profiles\skjrfnoq.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned with backup
:mozilla.67:C:\Documents and Settings\JASON FOWLER\Application Data\Mozilla\Firefox\Profiles\skjrfnoq.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned with backup
:mozilla.68:C:\Documents and Settings\JASON FOWLER\Application Data\Mozilla\Firefox\Profiles\skjrfnoq.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned with backup
:mozilla.77:C:\Documents and Settings\JASON FOWLER\Application Data\Mozilla\Firefox\Profiles\skjrfnoq.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup
:mozilla.78:C:\Documents and Settings\JASON FOWLER\Application Data\Mozilla\Firefox\Profiles\skjrfnoq.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup
:mozilla.79:C:\Documents and Settings\JASON FOWLER\Application Data\Mozilla\Firefox\Profiles\skjrfnoq.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup
:mozilla.91:C:\Documents and Settings\JASON FOWLER\Application Data\Mozilla\Firefox\Profiles\skjrfnoq.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned with backup
:mozilla.119:C:\Documents and Settings\JASON FOWLER\Application Data\Mozilla\Firefox\Profiles\skjrfnoq.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned with backup
:mozilla.120:C:\Documents and Settings\JASON FOWLER\Application Data\Mozilla\Firefox\Profiles\skjrfnoq.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned with backup
:mozilla.121:C:\Documents and Settings\JASON FOWLER\Application Data\Mozilla\Firefox\Profiles\skjrfnoq.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned with backup
:mozilla.122:C:\Documents and Settings\JASON FOWLER\Application Data\Mozilla\Firefox\Profiles\skjrfnoq.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned with backup
:mozilla.142:C:\Documents and Settings\JASON FOWLER\Application Data\Mozilla\Firefox\Profiles\skjrfnoq.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.209:C:\Documents and Settings\JASON FOWLER\Application Data\Mozilla\Firefox\Profiles\skjrfnoq.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned with backup
:mozilla.219:C:\Documents and Settings\JASON FOWLER\Application Data\Mozilla\Firefox\Profiles\skjrfnoq.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup
:mozilla.220:C:\Documents and Settings\JASON FOWLER\Application Data\Mozilla\Firefox\Profiles\skjrfnoq.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup
:mozilla.221:C:\Documents and Settings\JASON FOWLER\Application Data\Mozilla\Firefox\Profiles\skjrfnoq.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup
:mozilla.222:C:\Documents and Settings\JASON FOWLER\Application Data\Mozilla\Firefox\Profiles\skjrfnoq.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned with backup
:mozilla.230:C:\Documents and Settings\JASON FOWLER\Application Data\Mozilla\Firefox\Profiles\skjrfnoq.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup
:mozilla.231:C:\Documents and Settings\JASON FOWLER\Application Data\Mozilla\Firefox\Profiles\skjrfnoq.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup
:mozilla.232:C:\Documents and Settings\JASON FOWLER\Application Data\Mozilla\Firefox\Profiles\skjrfnoq.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup
:mozilla.233:C:\Documents and Settings\JASON FOWLER\Application Data\Mozilla\Firefox\Profiles\skjrfnoq.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup
:mozilla.234:C:\Documents and Settings\JASON FOWLER\Application Data\Mozilla\Firefox\Profiles\skjrfnoq.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup
:mozilla.235:C:\Documents and Settings\JASON FOWLER\Application Data\Mozilla\Firefox\Profiles\skjrfnoq.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned with backup
:mozilla.242:C:\Documents and Settings\JASON FOWLER\Application Data\Mozilla\Firefox\Profiles\skjrfnoq.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.243:C:\Documents and Settings\JASON FOWLER\Application Data\Mozilla\Firefox\Profiles\skjrfnoq.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.244:C:\Documents and Settings\JASON FOWLER\Application Data\Mozilla\Firefox\Profiles\skjrfnoq.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.245:C:\Documents and Settings\JASON FOWLER\Application Data\Mozilla\Firefox\Profiles\skjrfnoq.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.246:C:\Documents and Settings\JASON FOWLER\Application Data\Mozilla\Firefox\Profiles\skjrfnoq.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.247:C:\Documents and Settings\JASON FOWLER\Application Data\Mozilla\Firefox\Profiles\skjrfnoq.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.248:C:\Documents and Settings\JASON FOWLER\Application Data\Mozilla\Firefox\Profiles\skjrfnoq.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.249:C:\Documents and Settings\JASON FOWLER\Application Data\Mozilla\Firefox\Profiles\skjrfnoq.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.250:C:\Documents and Settings\JASON FOWLER\Application Data\Mozilla\Firefox\Profiles\skjrfnoq.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.251:C:\Documents and Settings\JASON FOWLER\Application Data\Mozilla\Firefox\Profiles\skjrfnoq.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned with backup
:mozilla.291:C:\Documents and Settings\JASON FOWLER\Application Data\Mozilla\Firefox\Profiles\skjrfnoq.default\cookies.txt -> TrackingCookie.Adserver : Cleaned with backup
:mozilla.292:C:\Documents and Settings\JASON FOWLER\Application Data\Mozilla\Firefox\Profiles\skjrfnoq.default\cookies.txt -> TrackingCookie.Adserver : Cleaned with backup
:mozilla.293:C:\Documents and Settings\JASON FOWLER\Application Data\Mozilla\Firefox\Profiles\skjrfnoq.default\cookies.txt -> TrackingCookie.Adserver : Cleaned with backup
:mozilla.294:C:\Documents and Settings\JASON FOWLER\Application Data\Mozilla\Firefox\Profiles\skjrfnoq.default\cookies.txt -> TrackingCookie.Adserver : Cleaned with backup
:mozilla.295:C:\Documents and Settings\JASON FOWLER\Application Data\Mozilla\Firefox\Profiles\skjrfnoq.default\cookies.txt -> TrackingCookie.Zedo : Cleaned with backup
:mozilla.296:C:\Documents and Settings\JASON FOWLER\Application Data\Mozilla\Firefox\Profiles\skjrfnoq.default\cookies.txt -> TrackingCookie.Zedo : Cleaned with backup
:mozilla.297:C:\Documents and Settings\JASON FOWLER\Application Data\Mozilla\Firefox\Profiles\skjrfnoq.default\cookies.txt -> TrackingCookie.Zedo : Cleaned with backup
:mozilla.298:C:\Documents and Settings\JASON FOWLER\Application Data\Mozilla\Firefox\Profiles\skjrfnoq.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.299:C:\Documents and Settings\JASON FOWLER\Application Data\Mozilla\Firefox\Profiles\skjrfnoq.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.317:C:\Documents and Settings\JASON FOWLER\Application Data\Mozilla\Firefox\Profiles\skjrfnoq.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup
:mozilla.318:C:\Documents and Settings\JASON FOWLER\Application Data\Mozilla\Firefox\Profiles\skjrfnoq.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned with backup
:mozilla.319:C:\Documents and Settings\JASON FOWLER\Application Data\Mozilla\Firefox\Profiles\skjrfnoq.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned with backup
:mozilla.320:C:\Documents and Settings\JASON FOWLER\Application Data\Mozilla\Firefox\Profiles\skjrfnoq.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned with backup
:mozilla.322:C:\Documents and Settings\JASON FOWLER\Application Data\Mozilla\Firefox\Profiles\skjrfnoq.default\cookies.txt -> TrackingCookie.Onestat : Cleaned with backup
:mozilla.323:C:\Documents and Settings\JASON FOWLER\Application Data\Mozilla\Firefox\Profiles\skjrfnoq.default\cookies.txt -> TrackingCookie.Onestat : Cleaned with backup
:mozilla.332:C:\Documents and Settings\JASON FOWLER\Application Data\Mozilla\Firefox\Profiles\skjrfnoq.default\cookies.txt -> TrackingCookie.Burstbeacon : Cleaned with backup
C:\Documents and Settings\JASON FOWLER\Cookies\jason fowler@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Cleaned with backup
C:\Documents and Settings\JASON FOWLER\Cookies\jason fowler@adopt.specificclick[1].txt -> TrackingCookie.Specificclick : Cleaned with backup
C:\Documents and Settings\JASON FOWLER\Cookies\jason fowler@com[2].txt -> TrackingCookie.Com : Cleaned with backup
C:\Documents and Settings\JASON FOWLER\Cookies\jason fowler@microsofteup.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup
C:\Documents and Settings\JASON FOWLER\Cookies\jason fowler@partygaming.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup
C:\Documents and Settings\JASON FOWLER\Cookies\jason fowler@sonycorporate.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup
C:\Documents and Settings\JASON FOWLER\Cookies\jason fowler@stats1.reliablestats[1].txt -> TrackingCookie.Reliablestats : Cleaned with backup
C:\WINDOWS\mtuninst.exe -> Adware.MediaTickets : Cleaned with backup
C:\WINDOWS\system32\azs.dll -> Adware.PurityScan : Cleaned with backup
C:\WINDOWS\system32\HyperLinker.exe -> Adware.MDH : Cleaned with backup
C:\WINDOWS\system32\oins.exe -> Adware.MediaTickets : Cleaned with backup
C:\WINDOWS\system32\PreUninstall.exe -> Adware.Suggestor : Cleaned with backup


::Report End


And here is the hijackthis report:
Logfile of HijackThis v1.99.1
Scan saved at 7:48:26 PM, on 3/2/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\HPQ\One-Touch\OneTouch.EXE
C:\WINDOWS\system32\carpserv.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\WINDOWS\system32\d?xplore.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\ICROSO~1.NET\lsass.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\ewido anti-malware\ewidoguard.exe
C:\WINDOWS\system32\HPConfig.exe
C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Documents and Settings\JASON FOWLER\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://qus8l.hpwis.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://my.netzero.ne...ch?r=minisearch
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://my.netzero.ne...ch?r=minisearch
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://my.netzero.ne...ch?r=minisearch
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = localhost:8080
R3 - URLSearchHook: (no name) - {B5DA7B3C-9BA4-F454-A4AE-E0CB599E5CC8} - C:\WINDOWS\system32\azs.dll (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {125376B9-8437-D29D-56C3-E4D5BDA1B5AC} - C:\WINDOWS\system32\avhmqkb.dll (file missing)
O2 - BHO: (no name) - {12E116BC-A824-92DB-7FC7-8B2D61D4F9CF} - C:\WINDOWS\system32\hhuoov.dll (file missing)
O2 - BHO: (no name) - {17C596B7-3663-3399-0BA7-57AE79E8E0F3} - C:\WINDOWS\system32\xvegdaa.dll (file missing)
O2 - BHO: (no name) - {227E46BA-A975-96DE-7BF4-DDF8FC98989B} - C:\WINDOWS\system32\avhmqkb.dll (file missing)
O2 - BHO: (no name) - {22CC26BF-8566-D698-52F0-B20020EDD4F8} - C:\WINDOWS\system32\hhuoov.dll (file missing)
O2 - BHO: (no name) - {277E46B9-A904-E7A9-7BF3-D4F88D91989C} - C:\WINDOWS\system32\avhmqkb.dll (file missing)
O2 - BHO: (no name) - {27E8A6B4-1B21-77DA-2690-6E8338D1CDC4} - C:\WINDOWS\system32\xvegdaa.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: (no name) - {93BC1D5B-A1B6-BC4B-9809-DEC81E8D2EC0} - C:\WINDOWS\system32\hvg.dll (file missing)
O2 - BHO: (no name) - {96BC1D58-A1C7-CD3C-980E-D7C86F842EC7} - C:\WINDOWS\system32\hvg.dll (file missing)
O2 - BHO: (no name) - {9D677D1A-9CD3-FB76-D65C-B23EB32B7A93} - C:\WINDOWS\system32\obmnwpo.dll (file missing)
O2 - BHO: (no name) - {A6912D5B-8C85-897F-B539-EEE52EBD03F0} - C:\WINDOWS\system32\hvg.dll (file missing)
O2 - BHO: (no name) - {B5DA7B3C-9BA4-F454-A4AE-E0CB599E5CC8} - C:\WINDOWS\system32\azs.dll (file missing)
O2 - BHO: (no name) - {D6EE7720-CBE5-A81D-B889-E79B6FAF31C0} - C:\WINDOWS\system32\vsvm.dll (file missing)
O2 - BHO: (no name) - {D6EE7726-CBE5-A81D-B889-EA9B6AA531C7} - C:\WINDOWS\system32\vsvm.dll (file missing)
O2 - BHO: (no name) - {E6C34725-E6A7-EC5E-95BE-D3B62B9C1CF0} - C:\WINDOWS\system32\vsvm.dll (file missing)
O2 - BHO: (no name) - {EB0B71BA-CB2D-F1D6-7DE1-BC9E89380790} - C:\WINDOWS\system32\jgd.dll (file missing)
O2 - BHO: (no name) - {FB003310-88D6-E376-D5E9-AC0FD09D4FC0} - C:\WINDOWS\system32\gqerydq.dll (file missing)
O2 - BHO: (no name) - {FD0D6904-80C4-BE39-CF1D-F6BADB3E13C1} - C:\WINDOWS\system32\rrrex.dll (file missing)
O3 - Toolbar: ZeroBar - {F5735C15-1FB2-41FE-BA12-242757E69DDE} - C:\Program Files\NetZero\toolbar.dll
O3 - Toolbar: ZeroBar - {F0F8ECBE-D460-4B34-B007-56A92E8F84A7} - C:\Program Files\NetZero\Toolbar.dll
O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
O4 - HKLM\..\Run: [QT4HPOT] C:\Program Files\HPQ\One-Touch\OneTouch.EXE
O4 - HKLM\..\Run: [PreloadApp] c:\hp\drivers\printers\photosmart\hphprld.exe c:\hp\drivers\printers\photosmart\setup.exe -d
O4 - HKLM\..\Run: [DXM6Patch_981116] C:\WINDOWS\p_981116.exe /Q:A
O4 - HKLM\..\Run: [Display Settings] C:\Program Files\HPQ\Notebook Utilities\hptasks.exe /s
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [lmu] C:\WINDOWS\LMU.exe
O4 - HKLM\..\Run: [hplampc] C:\WINDOWS\system32\hplampc.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKCU\..\Run: [NetZero_uoltray] C:\Program Files\NetZero\exec.exe regrun
O4 - HKCU\..\Run: [spc_w] "C:\Program Files\NZSearch\nzspc.exe" -w
O4 - HKCU\..\Run: [Qanwxfkv] C:\WINDOWS\system32\d?xplore.exe
O4 - HKCU\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Lerm] "C:\WINDOWS\ICROSO~1.NET\lsass.exe" -vt rbnd
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - c:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://qus8l.hpwis.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=48835
O16 - DPF: {31E68DE2-5548-4B23-88F0-C51E6A0F695E} (Microsoft PID Sniffer) - https://support.micr...ActiveX/odc.cab
O16 - DPF: {9A54032D-31F7-400D-B184-83B33BDE65FA} (MSN File Upload Control) - http://sc.groups.msn...eUC/MsnUpld.cab
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.c.../cpcScanner.cab
O16 - DPF: {F5C90925-ABBF-4475-88F5-8622B452BA9E} (Compaq System Data Class) - http://h30135.www3.h...er/SysQuery.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: HP Configuration Interface Service (HPConfig) - Hewlett-Packard - C:\WINDOWS\system32\HPConfig.exe
O23 - Service: HPWirelessMgr - Hewlett-Packard Co. - C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe

[LDTate]

You still have a few bad guys in there.

Please do not delete anything unless instructed to.


Download the trial version of Spy Sweeper from Here

Install it using the Standard Install option. (You will be asked for your e-mail address, it is safe to give it. If you receive alerts from your firewall, allow all activities for Spy Sweeper)

You will be prompted to check for updated definitions, please do so.
(This may take several minutes)

Click on Options > Sweep Options and check Sweep all Folders on Selected drives. Check Local Disc C. Under What to Sweep, check every box.

Click on Sweep and allow it to fully scan your system.If you are prompted to restart the computer, do so immediately. This is a necessary step to kill the infection!

When the sweep has finished, click Remove. Click Select All and then Next

From 'Results', select the Session Log tab. Click Save to File and save the log somewhere convenient.

Exit Spy Sweeper.

Empty Recycle Bin

Reboot and "copy/paste" a new HJT log as well as the Resullts from Spy Sweeper file into this thread.
Also please describe how your computer behaves at the moment.

[birdsnare]

LDTate,

The adserver seems to be gone. It's not popping up anymore, anyway. There may still be a little bit of sluggishness, but if so, it's not that noticable.

Here are the logs:
Spysweeper:
********
8:32 PM: | Start of Session, Thursday, March 02, 2006 |
8:32 PM: Spy Sweeper started
8:32 PM: Sweep initiated using definitions version 625
8:32 PM: Starting Memory Sweep
8:34 PM: Found Adware: purityscan
8:34 PM: Detected running threat: C:\WINDOWS\system32\d?xplore.exe (ID = 230)
8:34 PM: HKU\S-1-5-21-2250428225-622084900-1667994989-1005\Software\Microsoft\Windows\CurrentVersion\Run || Qanwxfkv (ID = 0)
8:34 PM: Detected running threat: C:\WINDOWS\?icrosoft.NET\lsass.exe (ID = 230)
8:36 PM: Memory Sweep Complete, Elapsed Time: 00:04:35
8:36 PM: Starting Registry Sweep
8:36 PM: Found Adware: ist istbar
8:36 PM: HKCR\interface\{2ddd90d6-f153-4ea7-a324-4b2d83d1027e}\ (8 subtraces) (ID = 129064)
8:36 PM: HKLM\software\classes\interface\{2ddd90d6-f153-4ea7-a324-4b2d83d1027e}\ (8 subtraces) (ID = 129087)
8:36 PM: Found Adware: linkmaker
8:36 PM: HKLM\software\lmu\ (4 subtraces) (ID = 129745)
8:36 PM: Found Adware: searchbar toolbar
8:36 PM: HKCR\clsid\{aa8c93e1-7e5f-497e-b67c-cc8fe2a40d3b}\ (10 subtraces) (ID = 140791)
8:36 PM: HKCR\interface\{9ce15eb5-6b39-4656-9e1f-2d219ee42e0e}\ (8 subtraces) (ID = 140792)
8:36 PM: HKLM\software\classes\clsid\{aa8c93e1-7e5f-497e-b67c-cc8fe2a40d3b}\ (10 subtraces) (ID = 140796)
8:36 PM: HKLM\software\classes\interface\{9ce15eb5-6b39-4656-9e1f-2d219ee42e0e}\ (8 subtraces) (ID = 140797)
8:37 PM: Found Adware: webrebates
8:37 PM: HKCR\clsid\{01fc5803-8644-45d7-877b-5a3924d8ecc4}\ (13 subtraces) (ID = 146292)
8:37 PM: HKLM\software\classes\clsid\{01fc5803-8644-45d7-877b-5a3924d8ecc4}\ (13 subtraces) (ID = 146294)
8:37 PM: HKLM\software\classes\typelib\{15e7d23b-736e-46fa-bffd-cbec4126befd}\ (9 subtraces) (ID = 146296)
8:37 PM: HKCR\typelib\{15e7d23b-736e-46fa-bffd-cbec4126befd}\ (9 subtraces) (ID = 146304)
8:37 PM: HKU\S-1-5-21-2250428225-622084900-1667994989-1005\software\e-ventures n.v.\ (ID = 140801)
8:37 PM: HKU\S-1-5-21-2250428225-622084900-1667994989-1005\software\microsoft\internet explorer\toolbar\webbrowser\ || {0a8ce102-fa03-4612-9bee-7fe5452f4cb1} (ID = 140805)
8:37 PM: Registry Sweep Complete, Elapsed Time:00:00:18
8:37 PM: Starting Cookie Sweep
8:37 PM: Found Spy Cookie: 2o7.net cookie
8:37 PM: jason fowler@2o7[1].txt (ID = 1957)
8:37 PM: Found Spy Cookie: go.com cookie
8:37 PM: jason fowler@abc.go[2].txt (ID = 2729)
8:37 PM: Found Spy Cookie: hbmediapro cookie
8:37 PM: jason fowler@adopt.hbmediapro[2].txt (ID = 2768)
8:37 PM: Found Spy Cookie: atwola cookie
8:37 PM: jason fowler@atwola[1].txt (ID = 2255)
8:37 PM: Found Spy Cookie: banners cookie
8:37 PM: jason fowler@banners[1].txt (ID = 2282)
8:37 PM: jason fowler@espn.go[1].txt (ID = 2729)
8:37 PM: Found Spy Cookie: exitexchange cookie
8:37 PM: jason fowler@exitexchange[2].txt (ID = 2633)
8:37 PM: jason fowler@go[2].txt (ID = 2728)
8:37 PM: Found Spy Cookie: clickandtrack cookie
8:37 PM: jason fowler@hits.clickandtrack[2].txt (ID = 2397)
8:37 PM: Found Spy Cookie: oinadserve cookie
8:37 PM: jason fowler@oinadserve[2].txt (ID = 3091)
8:37 PM: jason fowler@partygaming.122.2o7[1].txt (ID = 1958)
8:37 PM: Found Spy Cookie: partypoker cookie
8:37 PM: jason fowler@partypoker[1].txt (ID = 3111)
8:37 PM: Found Spy Cookie: overture cookie
8:37 PM: jason fowler@perf.overture[1].txt (ID = 3106)
8:37 PM: jason fowler@register.go[1].txt (ID = 2729)
8:37 PM: jason fowler@rsi.abc.go[1].txt (ID = 2729)
8:37 PM: jason fowler@rsi.espn.go[1].txt (ID = 2729)
8:37 PM: jason fowler@www.abc.go[1].txt (ID = 2729)
8:37 PM: Found Spy Cookie: adserver cookie
8:37 PM: jason fowler@z1.adserver[1].txt (ID = 2142)
8:37 PM: Cookie Sweep Complete, Elapsed Time: 00:00:00
8:37 PM: Starting File Sweep
8:53 PM: Found Adware: ebates money maker
8:53 PM: opr002jy.js (ID = 59644)
8:53 PM: imgconv.dll (ID = 83909)
8:55 PM: lmf32v.dll (ID = 65591)
9:02 PM: Found System Monitor: potentially rootkit-masked files
9:02 PM: fundamentalists were ambivalent toward sbc conservatives because they felt a kinship to the conservatives within the sbc and they were developing their own theology of separatism.doc (ID = 0)
9:04 PM: File Sweep Complete, Elapsed Time: 00:27:17
9:04 PM: Full Sweep has completed. Elapsed time 00:32:20
9:04 PM: Traces Found: 138
10:31 PM: Removal process initiated
10:32 PM: Quarantining All Traces: ist istbar
10:32 PM: Quarantining All Traces: potentially rootkit-masked files
10:32 PM: potentially rootkit-masked files is in use. It will be removed on reboot.
10:32 PM: fundamentalists were ambivalent toward sbc conservatives because they felt a kinship to the conservatives within the sbc and they were developing their own theology of separatism.doc is in use. It will be removed on reboot.
10:32 PM: Quarantining All Traces: purityscan
10:32 PM: Quarantining All Traces: ebates money maker
10:32 PM: Quarantining All Traces: linkmaker
10:32 PM: Quarantining All Traces: searchbar toolbar
10:32 PM: Quarantining All Traces: webrebates
10:32 PM: Quarantining All Traces: 2o7.net cookie
10:32 PM: Quarantining All Traces: adserver cookie
10:32 PM: Quarantining All Traces: atwola cookie
10:32 PM: Quarantining All Traces: banners cookie
10:32 PM: Quarantining All Traces: clickandtrack cookie
10:32 PM: Quarantining All Traces: exitexchange cookie
10:32 PM: Quarantining All Traces: go.com cookie
10:32 PM: Quarantining All Traces: hbmediapro cookie
10:32 PM: Quarantining All Traces: oinadserve cookie
10:32 PM: Quarantining All Traces: overture cookie
10:32 PM: Quarantining All Traces: partypoker cookie
10:32 PM: Preparing to restart your computer. Please wait...
10:32 PM: Removal process completed. Elapsed time 00:01:03
********
8:30 PM: | Start of Session, Thursday, March 02, 2006 |
8:30 PM: Spy Sweeper started
8:31 PM: Your spyware definitions have been updated.
8:32 PM: | End of Session, Thursday, March 02, 2006 |

Hijackthis
Logfile of HijackThis v1.99.1
Scan saved at 10:47:02 PM, on 3/2/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\HPQ\One-Touch\OneTouch.EXE
C:\WINDOWS\system32\carpserv.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\ewido anti-malware\ewidoguard.exe
C:\WINDOWS\system32\HPConfig.exe
C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\JASON FOWLER\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://qus8l.hpwis.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://my.netzero.ne...ch?r=minisearch
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://my.netzero.ne...ch?r=minisearch
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://my.netzero.ne...ch?r=minisearch
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = localhost:8080
R3 - URLSearchHook: (no name) - {B5DA7B3C-9BA4-F454-A4AE-E0CB599E5CC8} - C:\WINDOWS\system32\azs.dll (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {125376B9-8437-D29D-56C3-E4D5BDA1B5AC} - C:\WINDOWS\system32\avhmqkb.dll (file missing)
O2 - BHO: (no name) - {12E116BC-A824-92DB-7FC7-8B2D61D4F9CF} - C:\WINDOWS\system32\hhuoov.dll (file missing)
O2 - BHO: (no name) - {17C596B7-3663-3399-0BA7-57AE79E8E0F3} - C:\WINDOWS\system32\xvegdaa.dll (file missing)
O2 - BHO: (no name) - {227E46BA-A975-96DE-7BF4-DDF8FC98989B} - C:\WINDOWS\system32\avhmqkb.dll (file missing)
O2 - BHO: (no name) - {22CC26BF-8566-D698-52F0-B20020EDD4F8} - C:\WINDOWS\system32\hhuoov.dll (file missing)
O2 - BHO: (no name) - {277E46B9-A904-E7A9-7BF3-D4F88D91989C} - C:\WINDOWS\system32\avhmqkb.dll (file missing)
O2 - BHO: (no name) - {27E8A6B4-1B21-77DA-2690-6E8338D1CDC4} - C:\WINDOWS\system32\xvegdaa.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: (no name) - {93BC1D5B-A1B6-BC4B-9809-DEC81E8D2EC0} - C:\WINDOWS\system32\hvg.dll (file missing)
O2 - BHO: (no name) - {96BC1D58-A1C7-CD3C-980E-D7C86F842EC7} - C:\WINDOWS\system32\hvg.dll (file missing)
O2 - BHO: (no name) - {9D677D1A-9CD3-FB76-D65C-B23EB32B7A93} - C:\WINDOWS\system32\obmnwpo.dll (file missing)
O2 - BHO: (no name) - {A6912D5B-8C85-897F-B539-EEE52EBD03F0} - C:\WINDOWS\system32\hvg.dll (file missing)
O2 - BHO: (no name) - {B5DA7B3C-9BA4-F454-A4AE-E0CB599E5CC8} - C:\WINDOWS\system32\azs.dll (file missing)
O2 - BHO: (no name) - {D6EE7720-CBE5-A81D-B889-E79B6FAF31C0} - C:\WINDOWS\system32\vsvm.dll (file missing)
O2 - BHO: (no name) - {D6EE7726-CBE5-A81D-B889-EA9B6AA531C7} - C:\WINDOWS\system32\vsvm.dll (file missing)
O2 - BHO: (no name) - {E6C34725-E6A7-EC5E-95BE-D3B62B9C1CF0} - C:\WINDOWS\system32\vsvm.dll (file missing)
O2 - BHO: (no name) - {EB0B71BA-CB2D-F1D6-7DE1-BC9E89380790} - C:\WINDOWS\system32\jgd.dll (file missing)
O2 - BHO: (no name) - {FB003310-88D6-E376-D5E9-AC0FD09D4FC0} - C:\WINDOWS\system32\gqerydq.dll (file missing)
O2 - BHO: (no name) - {FD0D6904-80C4-BE39-CF1D-F6BADB3E13C1} - C:\WINDOWS\system32\rrrex.dll (file missing)
O3 - Toolbar: ZeroBar - {F5735C15-1FB2-41FE-BA12-242757E69DDE} - C:\Program Files\NetZero\toolbar.dll
O3 - Toolbar: ZeroBar - {F0F8ECBE-D460-4B34-B007-56A92E8F84A7} - C:\Program Files\NetZero\Toolbar.dll
O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
O4 - HKLM\..\Run: [QT4HPOT] C:\Program Files\HPQ\One-Touch\OneTouch.EXE
O4 - HKLM\..\Run: [PreloadApp] c:\hp\drivers\printers\photosmart\hphprld.exe c:\hp\drivers\printers\photosmart\setup.exe -d
O4 - HKLM\..\Run: [DXM6Patch_981116] C:\WINDOWS\p_981116.exe /Q:A
O4 - HKLM\..\Run: [Display Settings] C:\Program Files\HPQ\Notebook Utilities\hptasks.exe /s
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [lmu] C:\WINDOWS\LMU.exe
O4 - HKLM\..\Run: [hplampc] C:\WINDOWS\system32\hplampc.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKCU\..\Run: [NetZero_uoltray] C:\Program Files\NetZero\exec.exe regrun
O4 - HKCU\..\Run: [spc_w] "C:\Program Files\NZSearch\nzspc.exe" -w
O4 - HKCU\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Lerm] "C:\WINDOWS\ICROSO~1.NET\lsass.exe" -vt rbnd
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - c:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://qus8l.hpwis.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=48835
O16 - DPF: {31E68DE2-5548-4B23-88F0-C51E6A0F695E} (Microsoft PID Sniffer) - https://support.micr...ActiveX/odc.cab
O16 - DPF: {9A54032D-31F7-400D-B184-83B33BDE65FA} (MSN File Upload Control) - http://sc.groups.msn...eUC/MsnUpld.cab
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.c.../cpcScanner.cab
O16 - DPF: {F5C90925-ABBF-4475-88F5-8622B452BA9E} (Compaq System Data Class) - http://h30135.www3.h...er/SysQuery.cab
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: HP Configuration Interface Service (HPConfig) - Hewlett-Packard - C:\WINDOWS\system32\HPConfig.exe
O23 - Service: HPWirelessMgr - Hewlett-Packard Co. - C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe

Thanks,
birdsnare

[LDTate]

I suggest you do this:

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Clear "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Clear "Hide protected operating system files."
Click Apply, and then click OK.


Please do not delete anything unless instructed to.



Run hijackthis. Hit None of the above, Click Do a System Scan Only. Put a Check in the box on the left side on these:

R3 - URLSearchHook: (no name) - {B5DA7B3C-9BA4-F454-A4AE-E0CB599E5CC8} - C:\WINDOWS\system32\azs.dll (file missing)

O2 - BHO: (no name) - {125376B9-8437-D29D-56C3-E4D5BDA1B5AC} - C:\WINDOWS\system32\avhmqkb.dll (file missing)

O2 - BHO: (no name) - {12E116BC-A824-92DB-7FC7-8B2D61D4F9CF} - C:\WINDOWS\system32\hhuoov.dll (file missing)

O2 - BHO: (no name) - {17C596B7-3663-3399-0BA7-57AE79E8E0F3} - C:\WINDOWS\system32\xvegdaa.dll (file missing)

O2 - BHO: (no name) - {227E46BA-A975-96DE-7BF4-DDF8FC98989B} - C:\WINDOWS\system32\avhmqkb.dll (file missing)

O2 - BHO: (no name) - {22CC26BF-8566-D698-52F0-B20020EDD4F8} - C:\WINDOWS\system32\hhuoov.dll (file missing)

O2 - BHO: (no name) - {277E46B9-A904-E7A9-7BF3-D4F88D91989C} - C:\WINDOWS\system32\avhmqkb.dll (file missing)

O2 - BHO: (no name) - {27E8A6B4-1B21-77DA-2690-6E8338D1CDC4} - C:\WINDOWS\system32\xvegdaa.dll (file missing)

O2 - BHO: (no name) - {93BC1D5B-A1B6-BC4B-9809-DEC81E8D2EC0} - C:\WINDOWS\system32\hvg.dll (file missing)

O2 - BHO: (no name) - {96BC1D58-A1C7-CD3C-980E-D7C86F842EC7} - C:\WINDOWS\system32\hvg.dll (file missing)

O2 - BHO: (no name) - {9D677D1A-9CD3-FB76-D65C-B23EB32B7A93} - C:\WINDOWS\system32\obmnwpo.dll (file missing)

O2 - BHO: (no name) - {A6912D5B-8C85-897F-B539-EEE52EBD03F0} - C:\WINDOWS\system32\hvg.dll (file missing)

O2 - BHO: (no name) - {B5DA7B3C-9BA4-F454-A4AE-E0CB599E5CC8} - C:\WINDOWS\system32\azs.dll (file missing)

O2 - BHO: (no name) - {D6EE7720-CBE5-A81D-B889-E79B6FAF31C0} - C:\WINDOWS\system32\vsvm.dll (file missing)

O2 - BHO: (no name) - {D6EE7726-CBE5-A81D-B889-EA9B6AA531C7} - C:\WINDOWS\system32\vsvm.dll (file missing)

O2 - BHO: (no name) - {E6C34725-E6A7-EC5E-95BE-D3B62B9C1CF0} - C:\WINDOWS\system32\vsvm.dll (file missing)
O2 - BHO: (no name) - {EB0B71BA-CB2D-F1D6-7DE1-BC9E89380790} - C:\WINDOWS\system32\jgd.dll (file missing)

O2 - BHO: (no name) - {FB003310-88D6-E376-D5E9-AC0FD09D4FC0} - C:\WINDOWS\system32\gqerydq.dll (file missing)

O2 - BHO: (no name) - {FD0D6904-80C4-BE39-CF1D-F6BADB3E13C1} - C:\WINDOWS\system32\rrrex.dll (file missing)

O4 - HKLM\..\Run: [lmu] C:\WINDOWS\LMU.exe

O4 - HKCU\..\Run: [Lerm] "C:\WINDOWS\ICROSO~1.NET\lsass.exe" -vt rbnd

Close ALL windows and browsers except HijackThis and click "Fix checked"


Delete these Files if listed:
C:\WINDOWS\LMU.exe
C:\WINDOWS\ICROSO~1.NET\lsass.exe <Only located here



Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»
This program is for XP and Windows 2000 only
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

Reboot and "copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at the moment.

[LDTate]

I'm headed to bed. Will take this up tomorrow.

[birdsnare]

LD,

Sleep well. This can wait.

In the meantime, the computer seems to be running better. The popups still do not show up. It seems to be running a little faster.

Here is the highjackthis log:

Logfile of HijackThis v1.99.1
Scan saved at 11:21:19 PM, on 3/2/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\HPQ\One-Touch\OneTouch.EXE
C:\WINDOWS\system32\carpserv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\NetZero\exec.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\ewido anti-malware\ewidoguard.exe
C:\WINDOWS\system32\HPConfig.exe
C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\NetZero\exec.exe
C:\Documents and Settings\JASON FOWLER\Desktop\HijackThis.exe
C:\WINDOWS\system32\wuauclt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://qus8l.hpwis.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://my.netzero.ne...ch?r=minisearch
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://my.netzero.ne...ch?r=minisearch
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://my.netzero.ne...ch?r=minisearch
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = localhost:8080
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O3 - Toolbar: ZeroBar - {F5735C15-1FB2-41FE-BA12-242757E69DDE} - C:\Program Files\NetZero\toolbar.dll
O3 - Toolbar: ZeroBar - {F0F8ECBE-D460-4B34-B007-56A92E8F84A7} - C:\Program Files\NetZero\Toolbar.dll
O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
O4 - HKLM\..\Run: [QT4HPOT] C:\Program Files\HPQ\One-Touch\OneTouch.EXE
O4 - HKLM\..\Run: [PreloadApp] c:\hp\drivers\printers\photosmart\hphprld.exe c:\hp\drivers\printers\photosmart\setup.exe -d
O4 - HKLM\..\Run: [DXM6Patch_981116] C:\WINDOWS\p_981116.exe /Q:A
O4 - HKLM\..\Run: [Display Settings] C:\Program Files\HPQ\Notebook Utilities\hptasks.exe /s
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [hplampc] C:\WINDOWS\system32\hplampc.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKCU\..\Run: [NetZero_uoltray] C:\Program Files\NetZero\exec.exe regrun
O4 - HKCU\..\Run: [spc_w] "C:\Program Files\NZSearch\nzspc.exe" -w
O4 - HKCU\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - c:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://qus8l.hpwis.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=48835
O16 - DPF: {31E68DE2-5548-4B23-88F0-C51E6A0F695E} (Microsoft PID Sniffer) - https://support.micr...ActiveX/odc.cab
O16 - DPF: {9A54032D-31F7-400D-B184-83B33BDE65FA} (MSN File Upload Control) - http://sc.groups.msn...eUC/MsnUpld.cab
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.c.../cpcScanner.cab
O16 - DPF: {F5C90925-ABBF-4475-88F5-8622B452BA9E} (Compaq System Data Class) - http://h30135.www3.h...er/SysQuery.cab
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: HP Configuration Interface Service (HPConfig) - Hewlett-Packard - C:\WINDOWS\system32\HPConfig.exe
O23 - Service: HPWirelessMgr - Hewlett-Packard Co. - C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe

[LDTate]

lets see if this will help speed it up.

Use Add/Remove Programs and remove :
Ewido and Spysweeper, they are only 14 day trial versions.


Backup your Registry...
- Press "CTRL - ALT - DEL" keys all at the same time to start "Task Manager"
- In the Task Manager window click on "File", then from the drop-down menu select "New Task (Run...)"
- In the "Create New Task" window enter\type "regedit" (without quotes)
- Once Regedit opens click on the FILE menu and select Export
- Save the file as backup. Save the file somewhere you will remember and not delete.
IMPORTANT: make sure to set the export range to ALL



I recommend you download RegSeeker. Extract it to it's own folder, open and double click RegSeeker.exe to start the program. Maximize the window and click clean registry. Check all sections and click OK. When the scan is complete, verify the backup box in lower left corner is checked and click the select all button, then select all again. Then right click within the search results and select delete. Run it again and again, deleting everything it finds until it finds nothing. Reboot and make sure your programs are working properly, control panel and add/remove programs windows open, etc (basically just do a quick check of everything). In the event anything was 'broken', you can open RegSeeker, click backups and double click any/all files to put the information back. A reboot may be required for the effects to be seen. Reboot When done.

[birdsnare]

LDTate, I think that did it! The computer is acting faster than it has in months. Nothing seems to be broken. Thanks! --birdsnare

[LDTate]

Good Job

Log looks good

Note: This will remove all previous Restore Points

Turn off System Restore:

On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.

Restart your computer, turn it back on.

On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Remove the Check Turn off System Restore.
Click Apply, and then click OK.

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Check "Hide file extensions for known file types."
Under the "Hidden files" folder, Uncheck "Show hidden files and folders."
Check "Hide protected operating system files."
Click Apply, and then click OK.





If you dont have these three programs I would recommend that you get them. Spywareblaster, Spywareguard and IESPY AD. They will add 1000's of sites to your resticted zone and block some hijacks from happening. I also have a FREE FIREWALL and FREE ANTI VIRUS if you need one.

It is critical to have both a firewall and anti virus to protect your system.

Keep your system up to date and run Adaware & Spybot, once a week works, and hopefully you will be ok from here on. Both are available below.

Safe Surfing.

I would also suggest you read this:
So how did I get infected in the first place?
by Tony Klein

[LDTate]

Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoy...showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php