What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Popups, Performance Issues, etc.

3 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hi, I've been having popups and performance issues that I suspect to be spyware related with one of my computers at home. I've done some general virus scanning, but I have still been experiencing some problems. Any help with this matter would be greatly appreciated.

Here is my hijackthis log:

Logfile of HijackThis v1.99.1
Scan saved at 3:57:04 PM, on 5/7/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
c:\winnt\microsoftdrivers\etc\smss.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\PROGRA~1\NORTON~2\NORTON~2\NPROTECT.EXE
C:\Program Files\Norton SystemWorks\Password Manager\AcctMgr.exe
C:\WINDOWS\iexplorer.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\ATI Multimedia\main\launchpd.exe
C:\Program Files\ATI Multimedia\main\ATIDtct.EXE
C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\Program Files\ArcSoft\Media Card Companion\MCC Monitor.exe
C:\PROGRA~1\NORTON~2\NORTON~2\SPEEDD~1\NOPDB.EXE
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\System32\MsPMSPSv.exe
c:\winnt\microsoftdrivers\etc\lsass.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\APC\APC PowerChute Personal Edition\apcsystray.exe
C:\Program Files\Norton AntiVirus\OPScan.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Downloads\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: InfoDocReader Object - {295BA105-3506-4D25-B0DD-54346320BDC5} - C:\WINDOWS\System32\awvvs.dll
O2 - BHO: bho2gr Class - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - C:\Program Files\GetRight\xx2gr.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {77701e16-9bfe-4b63-a5b4-7bd156758a37} - (no file)
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [AcctMgr] C:\Program Files\Norton SystemWorks\Password Manager\AcctMgr.exe /startup
O4 - HKLM\..\Run: [Microsoft Internet Explorer] C:\WINDOWS\iexplorer.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\RunServices: [mIRC] C:\Program Files\mIRC\mirc.exe
O4 - HKLM\..\RunServices: [LoadPowerProfiles] C:\Windows\run.bat
O4 - HKCU\..\Run: [ATI Launchpad] "C:\Program Files\ATI Multimedia\main\launchpd.exe"
O4 - HKCU\..\Run: [ATI DeviceDetect] C:\Program Files\ATI Multimedia\main\ATIDtct.EXE
O4 - HKCU\..\Run: [ATI Remote Control] C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: APC UPS Status.lnk = ?
O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O4 - Global Startup: Monitor.lnk = C:\Program Files\ArcSoft\Media Card Companion\MCC Monitor.exe
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 2.0\resources\en-US\local\search.html
O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\MICROS~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O9 - Extra button: ATI TV - {44226DFF-747E-4edc-B30C-78752E50CD0C} - C:\Program Files\ATI Multimedia\tv\EXPLBAR.DLL
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Netscape\Communicator\Program\AIM\aim.exe
O9 - Extra button: ICQ 4.0 - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: Ebates - {6685509E-B47B-4f47-8E16-9A5F3A62F683} - file://C:\Program Files\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.htm (file missing) (HKCU)
O12 - Plugin for .do: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EP…l_v1-0-3-24.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/21330e7b6c9634…ip/RdxIE601.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O20 - Winlogon Notify: awvvs - C:\WINDOWS\System32\awvvs.dll
O23 - Service: APC UPS Service - American Power Conversion Corporation - C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: DNS Server DNS Server (DNS) - Unknown owner - c:\winnt\microsoftdrivers\etc\FireDaemon.exe
O23 - Service: Indexing Server indexing Server (indexing) - Unknown owner - c:\winnt\microsoftdrivers\etc\FireDaemon.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~2\NPROTECT.EXE
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~2\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: Windows Login Windows Login (Wlogin) - Unknown owner - c:\winnt\microsoftdrivers\etc\FireDaemon.exe
O23 - Service: X10 Device Network Service (x10nets) - Unknown owner - C:\PROGRA~1\ATIMUL~1\RemCtrl\x10nets.exe (file missing)
Post #2
Please download VundoFix.exe from here:

http://www.atribune.org/ccount/click.php?id=4

and save it to your desktop


Double-click VundoFix.exe to run it.

Checkmark the box "Run Vundo as task"

You will receive a message saying vundofix will close and re-open in a minute or less. Click OK

When VundoFix re-opens, click the Scan for Vundo button

Once it's done scanning, click the Remove Vundo button.

You will receive a prompt asking if you want to remove the files, click YES

Once you click yes, your desktop will go blank as it starts removing Vundo.

When completed, it will prompt that it will shutdown your computer, click OK.

Turn your computer back on.

NEXT

Please download the trial version of Ewido Security Suite here:

http://www.ewido.net/en/

Install it, and update the definitions to the newest files.

Next, please reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Select the first option, to run Windows in Safe Mode.

Then please run Ewido, and run a full scan. Save the logfile from the scan.

Restart your computer please post the contents of C:\vundofix.txt, the Ewido log and a new hijackthis log.
Post #3
Siggyx,

Thanks for your help! :)

This is the vundofix text;

VundoFix V4.2.74

Running as SYSTEM
from c:\windows\system32\VundoFix.exe

Checking Java version…

Java version is 1.4.2.4

Scan started at 5:30:14 PM 5/8/2006

Listing files found while scanning….

C:\WINDOWS\System32\awvvs.dll
C:\WINDOWS\System32\svvwa.ini
C:\WINDOWS\System32\svvwa.bak1
C:\WINDOWS\System32\svvwa.bak2
C:\WINDOWS\System32\svvwa.ini2
C:\WINDOWS\System32\svvwa.tmp

C:\WINDOWS\system32\svvwa.bak1
C:\WINDOWS\system32\svvwa.bak2
C:\WINDOWS\system32\svvwa.tmp
C:\WINDOWS\system32\svvwa.ini
C:\WINDOWS\system32\svvwa.ini2
C:\WINDOWS\system32\awvvs.dll
C:\WINDOWS\system32\svvwa.ini2
C:\WINDOWS\system32\svvwa.bak2
C:\WINDOWS\system32\svvwa.tmp
C:\WINDOWS\system32\svvwa.ini
C:\WINDOWS\system32\svvwa.ini2
C:\WINDOWS\system32\awvvs.dll
Attempting to delete C:\WINDOWS\System32\awvvs.dll
C:\WINDOWS\System32\awvvs.dll Has been deleted!

Attempting to delete C:\WINDOWS\System32\svvwa.ini
C:\WINDOWS\System32\svvwa.ini Has been deleted!

Attempting to delete C:\WINDOWS\System32\svvwa.bak1
C:\WINDOWS\System32\svvwa.bak1 Has been deleted!

Attempting to delete C:\WINDOWS\System32\svvwa.bak2
C:\WINDOWS\System32\svvwa.bak2 Has been deleted!

Attempting to delete C:\WINDOWS\System32\svvwa.ini2
C:\WINDOWS\System32\svvwa.ini2 Has been deleted!

Attempting to delete C:\WINDOWS\System32\svvwa.tmp
C:\WINDOWS\System32\svvwa.tmp Has been deleted!

Performing Repairs to the registry.
Done!


Here is the Ewido log;


———————————————————
ewido anti-malware - Scan report
———————————————————

+ Created on: 8:45:58 PM, 5/8/2006
+ Report-Checksum: CA355E25

+ Scan result:

HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\ins -> Adware.WebRebates : Cleaned with backup
C:\Program Files\Easy Video Converter\run.exe -> Logger.Briss.j : Cleaned with backup
:mozilla.21:C:\RECYCLER\NPROTECT\00037404.MOZ -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.22:C:\RECYCLER\NPROTECT\00037404.MOZ -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.26:C:\RECYCLER\NPROTECT\00037404.MOZ -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.27:C:\RECYCLER\NPROTECT\00037404.MOZ -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.28:C:\RECYCLER\NPROTECT\00037404.MOZ -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.29:C:\RECYCLER\NPROTECT\00037404.MOZ -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.30:C:\RECYCLER\NPROTECT\00037404.MOZ -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.31:C:\RECYCLER\NPROTECT\00037404.MOZ -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.48:C:\RECYCLER\NPROTECT\00037404.MOZ -> TrackingCookie.Tribalfusion : Cleaned with backup
:mozilla.49:C:\RECYCLER\NPROTECT\00037404.MOZ -> TrackingCookie.Tribalfusion : Cleaned with backup
:mozilla.50:C:\RECYCLER\NPROTECT\00037404.MOZ -> TrackingCookie.Tribalfusion : Cleaned with backup
:mozilla.51:C:\RECYCLER\NPROTECT\00037404.MOZ -> TrackingCookie.Tribalfusion : Cleaned with backup
:mozilla.53:C:\RECYCLER\NPROTECT\00037404.MOZ -> TrackingCookie.Atdmt : Cleaned with backup
:mozilla.55:C:\RECYCLER\NPROTECT\00037404.MOZ -> TrackingCookie.Mediaplex : Cleaned with backup
:mozilla.56:C:\RECYCLER\NPROTECT\00037404.MOZ -> TrackingCookie.Mediaplex : Cleaned with backup
:mozilla.58:C:\RECYCLER\NPROTECT\00037404.MOZ -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.59:C:\RECYCLER\NPROTECT\00037404.MOZ -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.60:C:\RECYCLER\NPROTECT\00037404.MOZ -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.61:C:\RECYCLER\NPROTECT\00037404.MOZ -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.62:C:\RECYCLER\NPROTECT\00037404.MOZ -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.64:C:\RECYCLER\NPROTECT\00037404.MOZ -> TrackingCookie.Doubleclick : Cleaned with backup
:mozilla.66:C:\RECYCLER\NPROTECT\00037404.MOZ -> TrackingCookie.Hitbox : Cleaned with backup
:mozilla.67:C:\RECYCLER\NPROTECT\00037404.MOZ -> TrackingCookie.Hitbox : Cleaned with backup
:mozilla.71:C:\RECYCLER\NPROTECT\00037404.MOZ -> TrackingCookie.Advertising : Cleaned with backup
:mozilla.72:C:\RECYCLER\NPROTECT\00037404.MOZ -> TrackingCookie.Hitbox : Cleaned with backup
:mozilla.73:C:\RECYCLER\NPROTECT\00037404.MOZ -> TrackingCookie.Advertising : Cleaned with backup
:mozilla.75:C:\RECYCLER\NPROTECT\00037404.MOZ -> TrackingCookie.Falkag : Cleaned with backup
:mozilla.76:C:\RECYCLER\NPROTECT\00037404.MOZ -> TrackingCookie.Falkag : Cleaned with backup
:mozilla.77:C:\RECYCLER\NPROTECT\00037404.MOZ -> TrackingCookie.Falkag : Cleaned with backup
:mozilla.78:C:\RECYCLER\NPROTECT\00037404.MOZ -> TrackingCookie.Falkag : Cleaned with backup
:mozilla.90:C:\RECYCLER\NPROTECT\00037404.MOZ -> TrackingCookie.Qksrv : Cleaned with backup
:mozilla.93:C:\RECYCLER\NPROTECT\00037404.MOZ -> TrackingCookie.Qksrv : Cleaned with backup
:mozilla.98:C:\RECYCLER\NPROTECT\00037404.MOZ -> TrackingCookie.Googleadservices : Cleaned with backup
:mozilla.99:C:\RECYCLER\NPROTECT\00037404.MOZ -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.100:C:\RECYCLER\NPROTECT\00037404.MOZ -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.101:C:\RECYCLER\NPROTECT\00037404.MOZ -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.102:C:\RECYCLER\NPROTECT\00037404.MOZ -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.103:C:\RECYCLER\NPROTECT\00037404.MOZ -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.104:C:\RECYCLER\NPROTECT\00037404.MOZ -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.105:C:\RECYCLER\NPROTECT\00037404.MOZ -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.106:C:\RECYCLER\NPROTECT\00037404.MOZ -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.151:C:\RECYCLER\NPROTECT\00037404.MOZ -> TrackingCookie.Hitbox : Cleaned with backup
:mozilla.152:C:\RECYCLER\NPROTECT\00037404.MOZ -> TrackingCookie.Hitbox : Cleaned with backup
:mozilla.153:C:\RECYCLER\NPROTECT\00037404.MOZ -> TrackingCookie.Hitbox : Cleaned with backup
:mozilla.155:C:\RECYCLER\NPROTECT\00037404.MOZ -> TrackingCookie.Hitbox : Cleaned with backup
:mozilla.171:C:\RECYCLER\NPROTECT\00037404.MOZ -> TrackingCookie.Reliablestats : Cleaned with backup
:mozilla.172:C:\RECYCLER\NPROTECT\00037404.MOZ -> TrackingCookie.Reliablestats : Cleaned with backup
:mozilla.175:C:\RECYCLER\NPROTECT\00037404.MOZ -> TrackingCookie.Reliablestats : Cleaned with backup
:mozilla.181:C:\RECYCLER\NPROTECT\00037404.MOZ -> TrackingCookie.Reliablestats : Cleaned with backup
:mozilla.185:C:\RECYCLER\NPROTECT\00037404.MOZ -> TrackingCookie.Reliablestats : Cleaned with backup
:mozilla.187:C:\RECYCLER\NPROTECT\00037404.MOZ -> TrackingCookie.Reliablestats : Cleaned with backup
:mozilla.205:C:\RECYCLER\NPROTECT\00037404.MOZ -> TrackingCookie.Reliablestats : Cleaned with backup
:mozilla.215:C:\RECYCLER\NPROTECT\00037404.MOZ -> TrackingCookie.Reliablestats : Cleaned with backup
:mozilla.216:C:\RECYCLER\NPROTECT\00037404.MOZ -> TrackingCookie.Reliablestats : Cleaned with backup
:mozilla.217:C:\RECYCLER\NPROTECT\00037404.MOZ -> TrackingCookie.Reliablestats : Cleaned with backup
:mozilla.219:C:\RECYCLER\NPROTECT\00037404.MOZ -> TrackingCookie.Myaffiliateprogram : Cleaned with backup
:mozilla.220:C:\RECYCLER\NPROTECT\00037404.MOZ -> TrackingCookie.Myaffiliateprogram : Cleaned with backup
:mozilla.221:C:\RECYCLER\NPROTECT\00037404.MOZ -> TrackingCookie.Tacoda : Cleaned with backup
:mozilla.223:C:\RECYCLER\NPROTECT\00037404.MOZ -> TrackingCookie.Tacoda : Cleaned with backup
:mozilla.227:C:\RECYCLER\NPROTECT\00037404.MOZ -> TrackingCookie.Reliablestats : Cleaned with backup
:mozilla.230:C:\RECYCLER\NPROTECT\00037404.MOZ -> TrackingCookie.Reliablestats : Cleaned with backup
:mozilla.231:C:\RECYCLER\NPROTECT\00037404.MOZ -> TrackingCookie.Reliablestats : Cleaned with backup
:mozilla.232:C:\RECYCLER\NPROTECT\00037404.MOZ -> TrackingCookie.Reliablestats : Cleaned with backup
:mozilla.263:C:\RECYCLER\NPROTECT\00037404.MOZ -> TrackingCookie.Cpvfeed : Cleaned with backup
:mozilla.278:C:\RECYCLER\NPROTECT\00037404.MOZ -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.297:C:\RECYCLER\NPROTECT\00037404.MOZ -> TrackingCookie.Com : Cleaned with backup
:mozilla.298:C:\RECYCLER\NPROTECT\00037404.MOZ -> TrackingCookie.Com : Cleaned with backup
:mozilla.300:C:\RECYCLER\NPROTECT\00037404.MOZ -> TrackingCookie.Googleadservices : Cleaned with backup
:mozilla.318:C:\RECYCLER\NPROTECT\00037404.MOZ -> TrackingCookie.Euroclick : Cleaned with backup
:mozilla.319:C:\RECYCLER\NPROTECT\00037404.MOZ -> TrackingCookie.Euroclick : Cleaned with backup
:mozilla.329:C:\RECYCLER\NPROTECT\00037404.MOZ -> TrackingCookie.Specificclick : Cleaned with backup
:mozilla.330:C:\RECYCLER\NPROTECT\00037404.MOZ -> TrackingCookie.Specificclick : Cleaned with backup
:mozilla.360:C:\RECYCLER\NPROTECT\00037404.MOZ -> TrackingCookie.Pointroll : Cleaned with backup
:mozilla.361:C:\RECYCLER\NPROTECT\00037404.MOZ -> TrackingCookie.Pointroll : Cleaned with backup
:mozilla.362:C:\RECYCLER\NPROTECT\00037404.MOZ -> TrackingCookie.Pointroll : Cleaned with backup
:mozilla.363:C:\RECYCLER\NPROTECT\00037404.MOZ -> TrackingCookie.Pointroll : Cleaned with backup
:mozilla.369:C:\RECYCLER\NPROTECT\00037404.MOZ -> TrackingCookie.Liveperson : Cleaned with backup
:mozilla.370:C:\RECYCLER\NPROTECT\00037404.MOZ -> TrackingCookie.Liveperson : Cleaned with backup
:mozilla.371:C:\RECYCLER\NPROTECT\00037404.MOZ -> TrackingCookie.Liveperson : Cleaned with backup
:mozilla.381:C:\RECYCLER\NPROTECT\00037404.MOZ -> TrackingCookie.Bfast : Cleaned with backup
:mozilla.388:C:\RECYCLER\NPROTECT\00037404.MOZ -> TrackingCookie.Burstnet : Cleaned with backup
:mozilla.23:C:\RECYCLER\NPROTECT\00038506.MOZ -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.24:C:\RECYCLER\NPROTECT\00038506.MOZ -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.28:C:\RECYCLER\NPROTECT\00038506.MOZ -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.29:C:\RECYCLER\NPROTECT\00038506.MOZ -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.30:C:\RECYCLER\NPROTECT\00038506.MOZ -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.31:C:\RECYCLER\NPROTECT\00038506.MOZ -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.32:C:\RECYCLER\NPROTECT\00038506.MOZ -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.33:C:\RECYCLER\NPROTECT\00038506.MOZ -> TrackingCookie.Yieldmanager : Cleaned with backup
:mozilla.48:C:\RECYCLER\NPROTECT\00038506.MOZ -> TrackingCookie.Tribalfusion : Cleaned with backup
:mozilla.49:C:\RECYCLER\NPROTECT\00038506.MOZ -> TrackingCookie.Tribalfusion : Cleaned with backup
:mozilla.50:C:\RECYCLER\NPROTECT\00038506.MOZ -> TrackingCookie.Tribalfusion : Cleaned with backup
:mozilla.52:C:\RECYCLER\NPROTECT\00038506.MOZ -> TrackingCookie.Atdmt : Cleaned with backup
:mozilla.53:C:\RECYCLER\NPROTECT\00038506.MOZ -> TrackingCookie.Mediaplex : Cleaned with backup
:mozilla.54:C:\RECYCLER\NPROTECT\00038506.MOZ -> TrackingCookie.Mediaplex : Cleaned with backup
:mozilla.56:C:\RECYCLER\NPROTECT\00038506.MOZ -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.57:C:\RECYCLER\NPROTECT\00038506.MOZ -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.58:C:\RECYCLER\NPROTECT\00038506.MOZ -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.59:C:\RECYCLER\NPROTECT\00038506.MOZ -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.60:C:\RECYCLER\NPROTECT\00038506.MOZ -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.62:C:\RECYCLER\NPROTECT\00038506.MOZ -> TrackingCookie.Doubleclick : Cleaned with backup
:mozilla.63:C:\RECYCLER\NPROTECT\00038506.MOZ -> TrackingCookie.Hitbox : Cleaned with backup
:mozilla.64:C:\RECYCLER\NPROTECT\00038506.MOZ -> TrackingCookie.Hitbox : Cleaned with backup
:mozilla.68:C:\RECYCLER\NPROTECT\00038506.MOZ -> TrackingCookie.Advertising : Cleaned with backup
:mozilla.69:C:\RECYCLER\NPROTECT\00038506.MOZ -> TrackingCookie.Hitbox : Cleaned with backup
:mozilla.70:C:\RECYCLER\NPROTECT\00038506.MOZ -> TrackingCookie.Advertising : Cleaned with backup
:mozilla.72:C:\RECYCLER\NPROTECT\00038506.MOZ -> TrackingCookie.Falkag : Cleaned with backup
:mozilla.73:C:\RECYCLER\NPROTECT\00038506.MOZ -> TrackingCookie.Falkag : Cleaned with backup
:mozilla.74:C:\RECYCLER\NPROTECT\00038506.MOZ -> TrackingCookie.Falkag : Cleaned with backup
:mozilla.86:C:\RECYCLER\NPROTECT\00038506.MOZ -> TrackingCookie.Qksrv : Cleaned with backup
:mozilla.89:C:\RECYCLER\NPROTECT\00038506.MOZ -> TrackingCookie.Qksrv : Cleaned with backup
:mozilla.94:C:\RECYCLER\NPROTECT\00038506.MOZ -> TrackingCookie.Googleadservices : Cleaned with backup
:mozilla.95:C:\RECYCLER\NPROTECT\00038506.MOZ -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.96:C:\RECYCLER\NPROTECT\00038506.MOZ -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.97:C:\RECYCLER\NPROTECT\00038506.MOZ -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.98:C:\RECYCLER\NPROTECT\00038506.MOZ -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.99:C:\RECYCLER\NPROTECT\00038506.MOZ -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.100:C:\RECYCLER\NPROTECT\00038506.MOZ -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.101:C:\RECYCLER\NPROTECT\00038506.MOZ -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.102:C:\RECYCLER\NPROTECT\00038506.MOZ -> TrackingCookie.Trafficmp : Cleaned with backup
:mozilla.147:C:\RECYCLER\NPROTECT\00038506.MOZ -> TrackingCookie.Hitbox : Cleaned with backup
:mozilla.148:C:\RECYCLER\NPROTECT\00038506.MOZ -> TrackingCookie.Hitbox : Cleaned with backup
:mozilla.149:C:\RECYCLER\NPROTECT\00038506.MOZ -> TrackingCookie.Hitbox : Cleaned with backup
:mozilla.151:C:\RECYCLER\NPROTECT\00038506.MOZ -> TrackingCookie.Hitbox : Cleaned with backup
:mozilla.167:C:\RECYCLER\NPROTECT\00038506.MOZ -> TrackingCookie.Reliablestats : Cleaned with backup
:mozilla.168:C:\RECYCLER\NPROTECT\00038506.MOZ -> TrackingCookie.Reliablestats : Cleaned with backup
:mozilla.171:C:\RECYCLER\NPROTECT\00038506.MOZ -> TrackingCookie.Reliablestats : Cleaned with backup
:mozilla.177:C:\RECYCLER\NPROTECT\00038506.MOZ -> TrackingCookie.Reliablestats : Cleaned with backup
:mozilla.181:C:\RECYCLER\NPROTECT\00038506.MOZ -> TrackingCookie.Reliablestats : Cleaned with backup
:mozilla.183:C:\RECYCLER\NPROTECT\00038506.MOZ -> TrackingCookie.Reliablestats : Cleaned with backup
:mozilla.201:C:\RECYCLER\NPROTECT\00038506.MOZ -> TrackingCookie.Reliablestats : Cleaned with backup
:mozilla.211:C:\RECYCLER\NPROTECT\00038506.MOZ -> TrackingCookie.Reliablestats : Cleaned with backup
:mozilla.212:C:\RECYCLER\NPROTECT\00038506.MOZ -> TrackingCookie.Reliablestats : Cleaned with backup
:mozilla.213:C:\RECYCLER\NPROTECT\00038506.MOZ -> TrackingCookie.Reliablestats : Cleaned with backup
:mozilla.215:C:\RECYCLER\NPROTECT\00038506.MOZ -> TrackingCookie.Myaffiliateprogram : Cleaned with backup
:mozilla.216:C:\RECYCLER\NPROTECT\00038506.MOZ -> TrackingCookie.Myaffiliateprogram : Cleaned with backup
:mozilla.217:C:\RECYCLER\NPROTECT\00038506.MOZ -> TrackingCookie.Tacoda : Cleaned with backup
:mozilla.219:C:\RECYCLER\NPROTECT\00038506.MOZ -> TrackingCookie.Tacoda : Cleaned with backup
:mozilla.223:C:\RECYCLER\NPROTECT\00038506.MOZ -> TrackingCookie.Reliablestats : Cleaned with backup
:mozilla.226:C:\RECYCLER\NPROTECT\00038506.MOZ -> TrackingCookie.Reliablestats : Cleaned with backup
:mozilla.227:C:\RECYCLER\NPROTECT\00038506.MOZ -> TrackingCookie.Reliablestats : Cleaned with backup
:mozilla.228:C:\RECYCLER\NPROTECT\00038506.MOZ -> TrackingCookie.Reliablestats : Cleaned with backup
:mozilla.259:C:\RECYCLER\NPROTECT\00038506.MOZ -> TrackingCookie.Cpvfeed : Cleaned with backup
:mozilla.273:C:\RECYCLER\NPROTECT\00038506.MOZ -> TrackingCookie.2o7 : Cleaned with backup
:mozilla.292:C:\RECYCLER\NPROTECT\00038506.MOZ -> TrackingCookie.Com : Cleaned with backup
:mozilla.293:C:\RECYCLER\NPROTECT\00038506.MOZ -> TrackingCookie.Com : Cleaned with backup
:mozilla.295:C:\RECYCLER\NPROTECT\00038506.MOZ -> TrackingCookie.Googleadservices : Cleaned with backup
:mozilla.313:C:\RECYCLER\NPROTECT\00038506.MOZ -> TrackingCookie.Euroclick : Cleaned with backup
:mozilla.314:C:\RECYCLER\NPROTECT\00038506.MOZ -> TrackingCookie.Euroclick : Cleaned with backup
:mozilla.324:C:\RECYCLER\NPROTECT\00038506.MOZ -> TrackingCookie.Specificclick : Cleaned with backup
:mozilla.325:C:\RECYCLER\NPROTECT\00038506.MOZ -> TrackingCookie.Specificclick : Cleaned with backup
:mozilla.355:C:\RECYCLER\NPROTECT\00038506.MOZ -> TrackingCookie.Pointroll : Cleaned with backup
:mozilla.356:C:\RECYCLER\NPROTECT\00038506.MOZ -> TrackingCookie.Pointroll : Cleaned with backup
:mozilla.357:C:\RECYCLER\NPROTECT\00038506.MOZ -> TrackingCookie.Pointroll : Cleaned with backup
:mozilla.358:C:\RECYCLER\NPROTECT\00038506.MOZ -> TrackingCookie.Pointroll : Cleaned with backup
:mozilla.364:C:\RECYCLER\NPROTECT\00038506.MOZ -> TrackingCookie.Liveperson : Cleaned with backup
:mozilla.365:C:\RECYCLER\NPROTECT\00038506.MOZ -> TrackingCookie.Liveperson : Cleaned with backup
:mozilla.366:C:\RECYCLER\NPROTECT\00038506.MOZ -> TrackingCookie.Liveperson : Cleaned with backup
:mozilla.376:C:\RECYCLER\NPROTECT\00038506.MOZ -> TrackingCookie.Bfast : Cleaned with backup
:mozilla.383:C:\RECYCLER\NPROTECT\00038506.MOZ -> TrackingCookie.Burstnet : Cleaned with backup
C:\WINDOWS\system32\ovspyktf.bdx -> Hijacker.Small.js : Cleaned with backup
C:\WINDOWS\winlog.exe -> Backdoor.Iroffer.14b2 : Cleaned with backup
D:\Data DVD Software downloads\Easy_Video_Converter_WinAll_Cracked_-_Convert_Anything_to_Anything_NTSC-PAL_-_[sYn].rar/EZVIDConvCrack.zip/run.exe -> Logger.Briss.j : Cleaned with backup


::Report End


And the hjackthis log;


Logfile of HijackThis v1.99.1
Scan saved at 8:56:51 PM, on 5/8/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
c:\winnt\microsoftdrivers\etc\FireDaemon.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\ewido anti-malware\ewidoguard.exe
c:\winnt\microsoftdrivers\etc\FireDaemon.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\PROGRA~1\NORTON~2\NORTON~2\NPROTECT.EXE
C:\PROGRA~1\NORTON~2\NORTON~2\SPEEDD~1\NOPDB.EXE
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
c:\winnt\microsoftdrivers\etc\FireDaemon.exe
C:\WINDOWS\System32\MsPMSPSv.exe
c:\winnt\microsoftdrivers\etc\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Norton SystemWorks\Password Manager\AcctMgr.exe
C:\WINDOWS\iexplorer.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\ATI Multimedia\main\launchpd.exe
C:\Program Files\ATI Multimedia\main\ATIDtct.EXE
C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\Program Files\ArcSoft\Media Card Companion\MCC Monitor.exe
C:\WINDOWS\System32\rundll32.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\APC\APC PowerChute Personal Edition\apcsystray.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Downloads\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: bho2gr Class - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - C:\Program Files\GetRight\xx2gr.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {77701e16-9bfe-4b63-a5b4-7bd156758a37} - (no file)
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [AcctMgr] C:\Program Files\Norton SystemWorks\Password Manager\AcctMgr.exe /startup
O4 - HKLM\..\Run: [Microsoft Internet Explorer] C:\WINDOWS\iexplorer.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\RunServices: [mIRC] C:\Program Files\mIRC\mirc.exe
O4 - HKLM\..\RunServices: [LoadPowerProfiles] C:\Windows\run.bat
O4 - HKCU\..\Run: [ATI Launchpad] "C:\Program Files\ATI Multimedia\main\launchpd.exe"
O4 - HKCU\..\Run: [ATI DeviceDetect] C:\Program Files\ATI Multimedia\main\ATIDtct.EXE
O4 - HKCU\..\Run: [ATI Remote Control] C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: APC UPS Status.lnk = ?
O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O4 - Global Startup: Monitor.lnk = C:\Program Files\ArcSoft\Media Card Companion\MCC Monitor.exe
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 2.0\resources\en-US\local\search.html
O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\MICROS~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O9 - Extra button: ATI TV - {44226DFF-747E-4edc-B30C-78752E50CD0C} - C:\Program Files\ATI Multimedia\tv\EXPLBAR.DLL
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Netscape\Communicator\Program\AIM\aim.exe
O9 - Extra button: ICQ 4.0 - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: Ebates - {6685509E-B47B-4f47-8E16-9A5F3A62F683} - file://C:\Program Files\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.htm (file missing) (HKCU)
O12 - Plugin for .do: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EP…l_v1-0-3-24.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/21330e7b6c9634…ip/RdxIE601.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O23 - Service: APC UPS Service - American Power Conversion Corporation - C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: DNS Server DNS Server (DNS) - Unknown owner - c:\winnt\microsoftdrivers\etc\FireDaemon.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: Indexing Server indexing Server (indexing) - Unknown owner - c:\winnt\microsoftdrivers\etc\FireDaemon.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~2\NPROTECT.EXE
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~2\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: Windows Login Windows Login (Wlogin) - Unknown owner - c:\winnt\microsoftdrivers\etc\FireDaemon.exe
O23 - Service: X10 Device Network Service (x10nets) - Unknown owner - C:\PROGRA~1\ATIMUL~1\RemCtrl\x10nets.exe (file missing)


Again thanks
Post #4
Please scan with hijackthis and put a check beside these lines and choose FIX

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank

O2 - BHO: (no name) - {77701e16-9bfe-4b63-a5b4-7bd156758a37} - (no file)

O4 - HKLM\..\RunServices: [LoadPowerProfiles] C:\Windows\run.bat

O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EP…l_v1-0-3-24.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/21330e7b6c9634…ip/RdxIE601.cab

Next reboot.

Please do an online scan with Kaspersky Online Scanner

You will be promted to install an ActiveX component from Kaspersky, Click Yes.
  • The program will launch and then start to download the latest definition files.
  • Once the scanner is installed and the definitions downloaded, click Next.
  • Now click on Scan Settings
  • In the scan settings make that the following are selected:
    • Scan using the following Anti-Virus database:
      • Extended (If available otherwise Standard)
    • Scan Options:
      • Scan Archives
      • Scan Mail Bases
  • Click OK
  • Now under select a target to scan select My Computer
  • The scan will take a while so be patient and let it run. Once the scan is complete it will display if your system has been infected.
  • Now click on the Save as Text button:
  • Save the file to your desktop.
  • Copy and paste that information in your next post as well as a bew hijackthis log please.
Post #5
Siggyx,

I put a check in the blocks as you said (beside the lines) and choose FIX.

I then rebooted just as you said, and then I ran the on-line Kaspersky scanner. Much of what Kaspersky found was in Norton Quarantine. I did not disinfect, and this is the text file after the Kaspersky scan;

——————————————————————————-
KASPERSKY ON-LINE SCANNER REPORT
Tuesday, May 09, 2006 10:09:27 PM
Operating System: Microsoft Windows XP Professional, Service Pack 1 (Build 2600)
Kaspersky On-line Scanner version: 5.0.78.0
Kaspersky Anti-Virus database last update: 10/05/2006
Kaspersky Anti-Virus database records: 192686
——————————————————————————-

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\
E:\
F:\
G:\

Scan Statistics:
Total number of scanned objects: 112832
Number of viruses found: 44
Number of infected objects: 91
Number of suspicious objects: 0
Duration of the scan process: 02:28:22

Infected Object Name / Virus Name / Last Action
C:\Downloads\vnc-4_1_1-x86_win32.exe/data0001 Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4110 skipped
C:\Downloads\vnc-4_1_1-x86_win32.exe Inno: infected - 1 skipped
C:\Movies\vnc-4_1_1-x86_win32.exe/data0001 Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4110 skipped
C:\Movies\vnc-4_1_1-x86_win32.exe Inno: infected - 1 skipped
C:\My Downloaded Files\mirc614.exe/data0001.bin Infected: not-a-virus:Client-IRC.Win32.mIRC.614 skipped
C:\My Downloaded Files\mirc614.exe mIRC: infected - 1 skipped
C:\Program Files\mIRC\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.614 skipped
C:\Program Files\Norton AntiVirus\Quarantine\01303061 Infected: Trojan-Downloader.Win32.Stubby.c skipped
C:\Program Files\Norton AntiVirus\Quarantine\06C35587 Infected: not-a-virus:AdWare.Win32.TimeSink skipped
C:\Program Files\Norton AntiVirus\Quarantine\07877C86 Infected: Backdoor.IRC.Zapchast skipped
C:\Program Files\Norton AntiVirus\Quarantine\0CC06C5F Infected: not-a-virus:AdWare.Win32.BiSpy.n skipped
C:\Program Files\Norton AntiVirus\Quarantine\0D485B29 Infected: Trojan-Dropper.Win32.Delf.z skipped
C:\Program Files\Norton AntiVirus\Quarantine\1061211A Infected: not-a-virus:Dialer.Win32.DialerOffline skipped
C:\Program Files\Norton AntiVirus\Quarantine\10644B17/data0003 Infected: not-a-virus:AdWare.Win32.WebRebates.f skipped
C:\Program Files\Norton AntiVirus\Quarantine\10644B17/data0004 Infected: not-a-virus:AdWare.Win32.WebRebates.d skipped
C:\Program Files\Norton AntiVirus\Quarantine\10644B17/data0005 Infected: not-a-virus:AdWare.Win32.WebRebates.c skipped
C:\Program Files\Norton AntiVirus\Quarantine\10644B17 NSIS: infected - 3 skipped
C:\Program Files\Norton AntiVirus\Quarantine\10644B17 CryptFF: infected - 3 skipped
C:\Program Files\Norton AntiVirus\Quarantine\10677513 Infected: not-a-virus:AdWare.Win32.TimeSink skipped
C:\Program Files\Norton AntiVirus\Quarantine\14FF1587 Infected: not-a-virus:AdWare.Win32.TimeSink skipped
C:\Program Files\Norton AntiVirus\Quarantine\154C46D6.raw Infected: Trojan-Proxy.Win32.Lager.bb skipped
C:\Program Files\Norton AntiVirus\Quarantine\184D4DD5 Infected: Virus.Win32.Parite.b skipped
C:\Program Files\Norton AntiVirus\Quarantine\23E1645D Infected: not-a-virus:AdWare.Win32.BiSpy.o skipped
C:\Program Files\Norton AntiVirus\Quarantine\24495969 Infected: not-a-virus:AdWare.Win32.180Solutions skipped
C:\Program Files\Norton AntiVirus\Quarantine\27937C71 Infected: not-a-virus:RiskTool.Win16.HideWindows skipped
C:\Program Files\Norton AntiVirus\Quarantine\2C9618E1 Infected: not-a-virus:AdWare.Win32.TimeSink skipped
C:\Program Files\Norton AntiVirus\Quarantine\2E925078 Infected: Backdoor.IRC.Zapchast skipped
C:\Program Files\Norton AntiVirus\Quarantine\31041DC6 Infected: Trojan-Clicker.Win32.Delf.r skipped
C:\Program Files\Norton AntiVirus\Quarantine\310747C3 Infected: not-a-virus:RemoteAdmin.Win32.RAdmin.20 skipped
C:\Program Files\Norton AntiVirus\Quarantine\310A71BF/stream/data0001 Infected: not-a-virus:AdWare.Win32.BargainBuddy.l skipped
C:\Program Files\Norton AntiVirus\Quarantine\310A71BF/stream/data0002 Infected: not-a-virus:AdWare.Win32.BargainBuddy.j skipped
C:\Program Files\Norton AntiVirus\Quarantine\310A71BF/stream/data0003 Infected: not-a-virus:AdWare.Win32.BargainBuddy.n skipped
C:\Program Files\Norton AntiVirus\Quarantine\310A71BF/stream/data0005/stream/data0002 Infected: not-a-virus:AdWare.Win32.BargainBuddy.y skipped
C:\Program Files\Norton AntiVirus\Quarantine\310A71BF/stream/data0005/stream/data0005 Infected: not-a-virus:AdWare.Win32.BargainBuddy.i skipped
C:\Program Files\Norton AntiVirus\Quarantine\310A71BF/stream/data0005/stream Infected: not-a-virus:AdWare.Win32.BargainBuddy.i skipped
C:\Program Files\Norton AntiVirus\Quarantine\310A71BF/stream/data0005 Infected: not-a-virus:AdWare.Win32.BargainBuddy.i skipped
C:\Program Files\Norton AntiVirus\Quarantine\310A71BF/stream Infected: not-a-virus:AdWare.Win32.BargainBuddy.i skipped
C:\Program Files\Norton AntiVirus\Quarantine\310A71BF NSIS: infected - 8 skipped
C:\Program Files\Norton AntiVirus\Quarantine\310A71BF CryptFF: infected - 8 skipped
C:\Program Files\Norton AntiVirus\Quarantine\310E1BBB Infected: not-a-virus:AdWare.Win32.BetterInternet skipped
C:\Program Files\Norton AntiVirus\Quarantine\311145B8 Infected: not-a-virus:AdWare.Win32.BiSpy.s skipped
C:\Program Files\Norton AntiVirus\Quarantine\31146FB4 Infected: Trojan-Downloader.Win32.Agent.ae skipped
C:\Program Files\Norton AntiVirus\Quarantine\311B43AD Infected: not-a-virus:AdWare.Win32.BiSpy.o skipped
C:\Program Files\Norton AntiVirus\Quarantine\311E6DA9 Infected: not-a-virus:AdWare.Win32.BiSpy.o skipped
C:\Program Files\Norton AntiVirus\Quarantine\312117A6 Infected: not-a-virus:AdWare.Win32.BetterInternet skipped
C:\Program Files\Norton AntiVirus\Quarantine\312541A2 Infected: Trojan-Downloader.Win32.Stubby.d skipped
C:\Program Files\Norton AntiVirus\Quarantine\31286B9F Infected: not-a-virus:AdWare.Win32.ImiBar.b skipped
C:\Program Files\Norton AntiVirus\Quarantine\312B159B Infected: Trojan-Downloader.Win32.Dyfuca.dc skipped
C:\Program Files\Norton AntiVirus\Quarantine\3741702C Infected: Backdoor.Win32.Padodor.ao skipped
C:\Program Files\Norton AntiVirus\Quarantine\37B003B1 Infected: Backdoor.Win32.Padodor.ao skipped
C:\Program Files\Norton AntiVirus\Quarantine\3B025C5A Infected: Trojan-Downloader.Win32.Intexp.a skipped
C:\Program Files\Norton AntiVirus\Quarantine\3E5344C8 Infected: not-a-virus:AdWare.Win32.TimeSink skipped
C:\Program Files\Norton AntiVirus\Quarantine\3FE46592 Infected: Trojan-Downloader.Win32.Dyfuca.da skipped
C:\Program Files\Norton AntiVirus\Quarantine\46F80E60 Infected: not-a-virus:AdWare.Win32.BetterInternet skipped
C:\Program Files\Norton AntiVirus\Quarantine\47E34DDE Infected: not-a-virus:AdWare.Win32.180Solutions skipped
C:\Program Files\Norton AntiVirus\Quarantine\47E677DA Infected: not-a-virus:AdWare.Win32.180Solutions skipped
C:\Program Files\Norton AntiVirus\Quarantine\47ED4BD3 Infected: not-a-virus:AdWare.Win32.180Solutions skipped
C:\Program Files\Norton AntiVirus\Quarantine\480126EB.exe/data0001 Infected: Trojan.Win32.Sisn skipped
C:\Program Files\Norton AntiVirus\Quarantine\480126EB.exe NSIS: infected - 1 skipped
C:\Program Files\Norton AntiVirus\Quarantine\480126EB.exe CryptFF: infected - 1 skipped
C:\Program Files\Norton AntiVirus\Quarantine\53B43ABB/data0001 Infected: not-a-virus:AdWare.Win32.WebRebates.g skipped
C:\Program Files\Norton AntiVirus\Quarantine\53B43ABB NSIS: infected - 1 skipped
C:\Program Files\Norton AntiVirus\Quarantine\53B43ABB CryptFF: infected - 1 skipped
C:\Program Files\Norton AntiVirus\Quarantine\5CE045FC.exe Infected: not-virus:BadJoke.Win32.JepRuss skipped
C:\Program Files\Norton AntiVirus\Quarantine\62EF6D68.exe Infected: Trojan-Proxy.Win32.Lager.bb skipped
C:\Program Files\Norton AntiVirus\Quarantine\62F54160.exe Infected: Packed.Win32.Tibs skipped
C:\Program Files\Norton AntiVirus\Quarantine\64777317.exe Infected: Backdoor.Win32.SdBot.gen skipped
C:\Program Files\Norton AntiVirus\Quarantine\681A7106 Infected: not-a-virus:RiskTool.Win16.HideWindows skipped
C:\Program Files\Norton AntiVirus\Quarantine\691940FE Infected: Trojan-Downloader.Win32.Agent.ae skipped
C:\Program Files\Norton AntiVirus\Quarantine\69A9425C Infected: Trojan-Spy.Win32.Briss.j skipped
C:\Program Files\Norton AntiVirus\Quarantine\7BFE4A12 Infected: not-a-virus:AdWare.Win32.BiSpy.s skipped
C:\WINDOWS\system\WINCONFIG\bot.dll Infected: Backdoor.IRC.Zapchast skipped
C:\WINDOWS\system\WINCONFIG\explorer.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.603 skipped
C:\WINDOWS\system\WINCONFIG\mirc.ini Infected: Backdoor.IRC.Zapchast skipped
C:\WINNT\microsoftdrivers\etc\lsass.exe Infected: not-a-virus:Server-FTP.Win32.Serv-U.3017 skipped
D:\Old 20 GB hard drive files\Emulators\Documents and Settings\Kevin\Local Settings\Temporary Internet Files\Content.IE5\IX9I32P8\directplugin[1] Infected: Exploit.HTML.CodeBaseExec skipped
D:\Old 20 GB hard drive files\Emulators\Documents and Settings\Kevin\Local Settings\Temporary Internet Files\Content.IE5\OPQVKHIV\nCaseInstaller[1].cab/nCaseInstaller.dll Infected: not-a-virus:AdWare.Win32.180Solutions skipped
D:\Old 20 GB hard drive files\Emulators\Documents and Settings\Kevin\Local Settings\Temporary Internet Files\Content.IE5\OPQVKHIV\nCaseInstaller[1].cab CAB: infected - 1 skipped
D:\Old 20 GB hard drive files\Program Files\Common Files\Totem Shared\Update\dial.dll.015 Infected: not-a-virus:Dialer.Win32.DialerOffline skipped
D:\Old 20 GB hard drive files\Program Files\Common Files\Totem Shared\Update\dial.dll.016 Infected: not-a-virus:Dialer.Win32.DialerOffline skipped
D:\Old 20 GB hard drive files\Program Files\Common Files\Totem Shared\Update\dial.dll.017 Infected: not-a-virus:Dialer.Win32.DialerOffline skipped
D:\Old 20 GB hard drive files\Program Files\Norton AntiVirus\Quarantine\3293232A Infected: Email-Worm.Win32.NetSky.q skipped
D:\Old 20 GB hard drive files\Program Files\Norton AntiVirus\Quarantine\4A230F3C Infected: Email-Worm.Win32.NetSky.q skipped
D:\Old 20 GB hard drive files\Program Files\Norton AntiVirus\Quarantine\675D64C9 Infected: Email-Worm.Win32.NetSky.q skipped
D:\Old 20 GB hard drive files\Program Files\Norton AntiVirus\Quarantine\67C94E52 Infected: Email-Worm.Win32.NetSky.q skipped
D:\Old 20 GB hard drive files\Program Files\Norton AntiVirus\Quarantine\68B24657 Infected: Email-Worm.Win32.Klez.h skipped
D:\Old 20 GB hard drive files\Program Files\Norton AntiVirus\Quarantine\7C3408FE Infected: Email-Worm.Win32.NetSky.q skipped
D:\Old 20 GB hard drive files\Programs\autumnfree.exe/asfree.exe/SAVENOWINST.EXE/SaveNow.exe Infected: not-a-virus:AdWare.Win32.SaveNow.ar skipped
D:\Old 20 GB hard drive files\Programs\autumnfree.exe/asfree.exe/SAVENOWINST.EXE Infected: not-a-virus:AdWare.Win32.SaveNow.ar skipped
D:\Old 20 GB hard drive files\Programs\autumnfree.exe/asfree.exe Infected: not-a-virus:AdWare.Win32.SaveNow.ar skipped
D:\Old 20 GB hard drive files\Programs\autumnfree.exe ZIP: infected - 3 skipped

Scan process completed.


This is the new hijackthis after the hijackthis removal of the checked marked boxes and the Kaspersky scan;


Logfile of HijackThis v1.99.1
Scan saved at 10:18:50 PM, on 5/9/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Norton SystemWorks\Password Manager\AcctMgr.exe
C:\WINDOWS\iexplorer.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\ATI Multimedia\main\ATIDtct.EXE
C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe
C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\Program Files\ArcSoft\Media Card Companion\MCC Monitor.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\System32\rundll32.exe
c:\winnt\microsoftdrivers\etc\FireDaemon.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\ewido anti-malware\ewidoguard.exe
C:\Program Files\APC\APC PowerChute Personal Edition\apcsystray.exe
c:\winnt\microsoftdrivers\etc\FireDaemon.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\PROGRA~1\NORTON~2\NORTON~2\NPROTECT.EXE
C:\PROGRA~1\NORTON~2\NORTON~2\SPEEDD~1\NOPDB.EXE
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
c:\winnt\microsoftdrivers\etc\FireDaemon.exe
c:\winnt\microsoftdrivers\etc\lsass.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Azureus\Azureus.exe
C:\Microsoft office\OFFICE11\OUTLOOK.EXE
C:\Microsoft office\OFFICE11\WINWORD.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Downloads\hijackthis\HijackThis.exe

R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: bho2gr Class - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - C:\Program Files\GetRight\xx2gr.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [AcctMgr] C:\Program Files\Norton SystemWorks\Password Manager\AcctMgr.exe /startup
O4 - HKLM\..\Run: [Microsoft Internet Explorer] C:\WINDOWS\iexplorer.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\RunServices: [mIRC] C:\Program Files\mIRC\mirc.exe
O4 - HKCU\..\Run: [ATI Launchpad] "C:\Program Files\ATI Multimedia\main\launchpd.exe"
O4 - HKCU\..\Run: [ATI DeviceDetect] C:\Program Files\ATI Multimedia\main\ATIDtct.EXE
O4 - HKCU\..\Run: [ATI Remote Control] C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: APC UPS Status.lnk = ?
O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O4 - Global Startup: Monitor.lnk = C:\Program Files\ArcSoft\Media Card Companion\MCC Monitor.exe
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 2.0\resources\en-US\local\search.html
O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\MICROS~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O9 - Extra button: ATI TV - {44226DFF-747E-4edc-B30C-78752E50CD0C} - C:\Program Files\ATI Multimedia\tv\EXPLBAR.DLL
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Netscape\Communicator\Program\AIM\aim.exe
O9 - Extra button: ICQ 4.0 - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: Ebates - {6685509E-B47B-4f47-8E16-9A5F3A62F683} - file://C:\Program Files\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.htm (file missing) (HKCU)
O12 - Plugin for .do: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O23 - Service: APC UPS Service - American Power Conversion Corporation - C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: DNS Server DNS Server (DNS) - Unknown owner - c:\winnt\microsoftdrivers\etc\FireDaemon.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: Indexing Server indexing Server (indexing) - Unknown owner - c:\winnt\microsoftdrivers\etc\FireDaemon.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~2\NPROTECT.EXE
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~2\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: Windows Login Windows Login (Wlogin) - Unknown owner - c:\winnt\microsoftdrivers\etc\FireDaemon.exe
O23 - Service: X10 Device Network Service (x10nets) - Unknown owner - C:\PROGRA~1\ATIMUL~1\RemCtrl\x10nets.exe (file missing)

Again, thanks for all the support you have given me.
Post #6
Please download Asquared from the link below.

http://www.emsisoft.com/en/software/download/

Safe it to your desktop. Next open and check for updates.

Boot to safe mode (tap f8 while bios loads)

Then scan your system (this will take some time) after the scan is compelte allow it to fix what it has found. If there is something that it can not clean please let me know what it was.

Then reboot and post a new hijackthis log.
Post #7
Siggyx,

This is the new hijackthis log;

Logfile of HijackThis v1.99.1
Scan saved at 7:33:33 PM, on 5/10/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
c:\winnt\microsoftdrivers\etc\FireDaemon.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\ewido anti-malware\ewidoguard.exe
c:\winnt\microsoftdrivers\etc\FireDaemon.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\PROGRA~1\NORTON~2\NORTON~2\NPROTECT.EXE
C:\PROGRA~1\NORTON~2\NORTON~2\SPEEDD~1\NOPDB.EXE
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\System32\wdfmgr.exe
c:\winnt\microsoftdrivers\etc\FireDaemon.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Norton SystemWorks\Password Manager\AcctMgr.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\ATI Multimedia\main\launchpd.exe
C:\Program Files\ATI Multimedia\main\ATIDtct.EXE
C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe
C:\Program Files\a-squared\a2guard.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\ArcSoft\Media Card Companion\MCC Monitor.exe
C:\Program Files\APC\APC PowerChute Personal Edition\apcsystray.exe
C:\Program Files\Azureus\Azureus.exe
C:\Microsoft office\OFFICE11\OUTLOOK.EXE
C:\Microsoft office\OFFICE11\WINWORD.EXE
C:\Program Files\Norton AntiVirus\OPScan.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Downloads\hijackthis\HijackThis.exe

R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: bho2gr Class - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - C:\Program Files\GetRight\xx2gr.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [AcctMgr] C:\Program Files\Norton SystemWorks\Password Manager\AcctMgr.exe /startup
O4 - HKLM\..\Run: [Microsoft Internet Explorer] C:\WINDOWS\iexplorer.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\RunServices: [mIRC] C:\Program Files\mIRC\mirc.exe
O4 - HKCU\..\Run: [ATI Launchpad] "C:\Program Files\ATI Multimedia\main\launchpd.exe"
O4 - HKCU\..\Run: [ATI DeviceDetect] C:\Program Files\ATI Multimedia\main\ATIDtct.EXE
O4 - HKCU\..\Run: [ATI Remote Control] C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe
O4 - HKCU\..\Run: [a-squared] "C:\Program Files\a-squared\a2guard.exe"
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: APC UPS Status.lnk = ?
O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O4 - Global Startup: Monitor.lnk = C:\Program Files\ArcSoft\Media Card Companion\MCC Monitor.exe
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 2.0\resources\en-US\local\search.html
O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\MICROS~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O9 - Extra button: ATI TV - {44226DFF-747E-4edc-B30C-78752E50CD0C} - C:\Program Files\ATI Multimedia\tv\EXPLBAR.DLL
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Netscape\Communicator\Program\AIM\aim.exe
O9 - Extra button: ICQ 4.0 - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE (file missing)
O12 - Plugin for .do: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O23 - Service: APC UPS Service - American Power Conversion Corporation - C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: DNS Server DNS Server (DNS) - Unknown owner - c:\winnt\microsoftdrivers\etc\FireDaemon.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: Indexing Server indexing Server (indexing) - Unknown owner - c:\winnt\microsoftdrivers\etc\FireDaemon.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~2\NPROTECT.EXE
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~2\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: Windows Login Windows Login (Wlogin) - Unknown owner - c:\winnt\microsoftdrivers\etc\FireDaemon.exe
O23 - Service: X10 Device Network Service (x10nets) - Unknown owner - C:\PROGRA~1\ATIMUL~1\RemCtrl\x10nets.exe (file missing)

Thanks again
Post #9
Stggyx, It seams to be running just fine now. Thank you for all the support you have given me. I could not have done it without you.
Post #10
Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI